wave5: vagrant-0001 flagship + 32-target CI/CD/IaC scan survey

vagrant-0001: bundler.rb plugin loader runs Array#include? against
plugins.keys / system_plugins inside per-spec loops. O(S*P) per
vagrant command. Fix: hoist Set.new outside the loop, O(1) per
spec lookup. Bench: 127x at S=2000 P=1000.

wave5-cicd-iac-survey.md: documents 32 projects scanned across
deployment (Spinnaker, fluxcd, Argo Rollouts/Events), modern CI/CD
(Earthly, Dagger, Buck2), container runtime (containerd, crun,
skopeo, ko, kaniko, buildah), local k8s (kind, minikube, k3s),
IaC + testing (Packer, Vagrant, ansible-lint, Molecule, InSpec,
Terratest), contract/mutation testing (Pact, Stryker, mutmut,
PIT), security (Semgrep, Bandit, gosec), Java quality (Spotbugs,
Checkstyle, chart-testing).

Clean-scan honor roll +4: chart-testing, kind, ko, pact-ruby.

2026-04-25 10:01:56 -04:00

1.9 KiB

Raw Blame History

Vagrant — CWE-407 Disclosure Brief

Project: Vagrant (hashicorp/vagrant) Disclosure date: 2026-04-25 Severity: MEDIUM Speedup: 127× measured at S=2000 specs × P=1000 plugins Status: patch-ready, 1 patch + bench

Summary

Vagrant runs its Bundler plugin resolver on every command — vagrant up, vagrant ssh, vagrant plugin list, every interaction. Two paths in lib/vagrant/bundler.rb walk the resolved gem-spec list and check membership against a plugin/system-plugin Array via Array#include?, an O(P) linear scan per spec. With S resolved specs and P plugins, total per-command cost is O(S×P).

Multi-plugin developer environments pay this on every command. The fix hoists each lookup into a Set — Set#include? is O(1).

The Defects

vagrant-0001 (MOAD-0001 — MEDIUM): lib/vagrant/bundler.rb:469-471, 533-534

# Path 1: prune solution to declared plugins
solution.find_all do |spec|
  plugins.keys.include?(spec.name)   # O(P) per spec, O(S*P) total
end

# Path 2: strict-dependency-enforcement filter
plugin_deps += vagrant_internal_specs.map do |spec|
  if Vagrant.in_bundler?
    next if system_plugins.include?(spec.name)   # O(I) per spec
    ...
  end
end

Fix: Build a Set once before each loop. require "set" already loaded at line 6.

Benchmark (S specs × P plugins)	defective	fixed	speedup
200×100	0.44ms	0.05ms	9.0×
500×200	2.32ms	0.14ms	16.1×
1000×500	6.80ms	0.12ms	59.3×
2000×1000	30.15ms	0.24ms	127.1×

Scanner Evidence

unmoad flags both call sites at HIGH severity via the array-includes-in-loop rule.

Patches

vagrant-0001-bundler-plugin-include-in-loop.patch

1.9 KiB Raw Blame History Unescape Escape