217 lines
7.8 KiB
Java
217 lines
7.8 KiB
Java
import java.util.*;
|
|
|
|
/**
|
|
* CWE-407 unit tests for Dolibarr defects.
|
|
*
|
|
* dolibarr-0001: filecheck.php in_array($tmprelativefilename, $file_list['insignature'])
|
|
* — O(S*I) file membership check during integrity verification
|
|
* dolibarr-0002: datapolicycron.class.php in_array($obj->rowid, $processedIds)
|
|
* — O(N^2) dedup accumulator in GDPR data policy cron
|
|
* dolibarr-0003: bookkeeping.class.php in_array($bookKeeping->piece_num, $alreadyExtourneT)
|
|
* — O(P*E*A) reversal check in accounting journal extourne
|
|
*/
|
|
public class DolibarrCWE407Test {
|
|
|
|
// ---- dolibarr-0001: filecheck insignature membership ----
|
|
|
|
/** Unpatched: in_array on plain array — O(S*I) */
|
|
static int filecheckUnpatched(List<String> scanFiles, List<String> inSignature) {
|
|
List<String> added = new ArrayList<>();
|
|
for (String file : scanFiles) {
|
|
if (!inSignature.contains(file)) { // O(I) per file
|
|
added.add(file);
|
|
}
|
|
}
|
|
return added.size();
|
|
}
|
|
|
|
/** Patched: array_flip for O(1) lookup — O(S+I) */
|
|
static int filecheckPatched(List<String> scanFiles, List<String> inSignature) {
|
|
Set<String> sigSet = new HashSet<>(inSignature); // O(I) once
|
|
List<String> added = new ArrayList<>();
|
|
for (String file : scanFiles) {
|
|
if (!sigSet.contains(file)) { // O(1) per file
|
|
added.add(file);
|
|
}
|
|
}
|
|
return added.size();
|
|
}
|
|
|
|
// ---- dolibarr-0002: datapolicycron processedIds dedup ----
|
|
|
|
/** Unpatched: in_array on growing processedIds — O(N^2) */
|
|
static int datapolicyCronUnpatched(List<Integer> dbRows) {
|
|
List<Integer> processedIds = new ArrayList<>();
|
|
int processed = 0;
|
|
for (int rowid : dbRows) {
|
|
if (!processedIds.contains(rowid)) { // O(N) scan
|
|
processed++;
|
|
processedIds.add(rowid);
|
|
}
|
|
}
|
|
return processed;
|
|
}
|
|
|
|
/** Patched: array_flip for O(1) lookup — O(N) total */
|
|
static int datapolicyCronPatched(List<Integer> dbRows) {
|
|
Set<Integer> processedSet = new HashSet<>();
|
|
int processed = 0;
|
|
for (int rowid : dbRows) {
|
|
if (!processedSet.contains(rowid)) { // O(1) lookup
|
|
processed++;
|
|
processedSet.add(rowid);
|
|
}
|
|
}
|
|
return processed;
|
|
}
|
|
|
|
// ---- dolibarr-0003: bookkeeping extourne reversal check ----
|
|
|
|
/** Unpatched: in_array on alreadyExtourneT — O(P*E*A) */
|
|
static int extourneUnpatched(List<Integer> pieceNums, List<Integer> alreadyExtourne) {
|
|
int reversed = 0;
|
|
for (int pieceNum : pieceNums) {
|
|
// Inner loop simulates fetching entries per piece
|
|
for (int entry = 0; entry < 5; entry++) {
|
|
if (alreadyExtourne.contains(pieceNum)) { // O(A) scan
|
|
// already reversed — skip
|
|
} else {
|
|
reversed++;
|
|
}
|
|
}
|
|
}
|
|
return reversed;
|
|
}
|
|
|
|
/** Patched: hash set for O(1) lookup — O(P*E + A) */
|
|
static int extournePatched(List<Integer> pieceNums, List<Integer> alreadyExtourne) {
|
|
Set<Integer> alreadySet = new HashSet<>(alreadyExtourne); // O(A) once
|
|
int reversed = 0;
|
|
for (int pieceNum : pieceNums) {
|
|
for (int entry = 0; entry < 5; entry++) {
|
|
if (alreadySet.contains(pieceNum)) { // O(1) lookup
|
|
// already reversed — skip
|
|
} else {
|
|
reversed++;
|
|
}
|
|
}
|
|
}
|
|
return reversed;
|
|
}
|
|
|
|
// ---- Test harness ----
|
|
|
|
static void testDolibarr0001() {
|
|
System.out.println("=== dolibarr-0001: filecheck insignature membership ===");
|
|
int S = 16000; // scanned files (typical Dolibarr installation)
|
|
int I = 14000; // files in signature
|
|
|
|
List<String> scanFiles = new ArrayList<>(S);
|
|
List<String> inSignature = new ArrayList<>(I);
|
|
for (int i = 0; i < I; i++) {
|
|
String name = "/htdocs/module" + (i / 100) + "/file" + i + ".php";
|
|
inSignature.add(name);
|
|
scanFiles.add(name);
|
|
}
|
|
// Add some files not in signature
|
|
for (int i = I; i < S; i++) {
|
|
scanFiles.add("/htdocs/custom/file" + i + ".php");
|
|
}
|
|
|
|
// Warmup
|
|
filecheckPatched(scanFiles, inSignature);
|
|
|
|
long t0 = System.nanoTime();
|
|
int r1 = filecheckUnpatched(scanFiles, inSignature);
|
|
long unpatched = System.nanoTime() - t0;
|
|
|
|
t0 = System.nanoTime();
|
|
int r2 = filecheckPatched(scanFiles, inSignature);
|
|
long patched = System.nanoTime() - t0;
|
|
|
|
assert r1 == r2 : "Result mismatch";
|
|
assert r1 == (S - I) : "Expected " + (S - I) + " added files, got " + r1;
|
|
|
|
double ratio = (double) unpatched / patched;
|
|
System.out.printf(" S=%d I=%d unpatched=%dms patched=%dms ratio=%.1fx%n",
|
|
S, I, unpatched / 1_000_000, patched / 1_000_000, ratio);
|
|
assert ratio > 5.0 : "Expected >5x ratio, got " + ratio;
|
|
System.out.println(" PASS");
|
|
}
|
|
|
|
static void testDolibarr0002() {
|
|
System.out.println("=== dolibarr-0002: datapolicycron processedIds dedup ===");
|
|
int N = 10000; // GDPR records to process
|
|
|
|
List<Integer> dbRows = new ArrayList<>(N);
|
|
for (int i = 0; i < N; i++) {
|
|
dbRows.add(i);
|
|
}
|
|
// Add some duplicates
|
|
for (int i = 0; i < N / 10; i++) {
|
|
dbRows.add(i);
|
|
}
|
|
|
|
// Warmup
|
|
datapolicyCronPatched(dbRows);
|
|
|
|
long t0 = System.nanoTime();
|
|
int r1 = datapolicyCronUnpatched(dbRows);
|
|
long unpatched = System.nanoTime() - t0;
|
|
|
|
t0 = System.nanoTime();
|
|
int r2 = datapolicyCronPatched(dbRows);
|
|
long patched = System.nanoTime() - t0;
|
|
|
|
assert r1 == r2 : "Result mismatch";
|
|
assert r1 == N : "Expected " + N + " unique, got " + r1;
|
|
|
|
double ratio = (double) unpatched / patched;
|
|
System.out.printf(" N=%d unpatched=%dms patched=%dms ratio=%.1fx%n",
|
|
N, unpatched / 1_000_000, patched / 1_000_000, ratio);
|
|
assert ratio > 5.0 : "Expected >5x ratio, got " + ratio;
|
|
System.out.println(" PASS");
|
|
}
|
|
|
|
static void testDolibarr0003() {
|
|
System.out.println("=== dolibarr-0003: bookkeeping extourne reversal check ===");
|
|
int P = 2000; // pieces to reverse
|
|
int A = 5000; // already-reversed pieces
|
|
|
|
List<Integer> pieceNums = new ArrayList<>(P);
|
|
for (int i = 0; i < P; i++) {
|
|
pieceNums.add(A + i); // new pieces not in already-reversed set
|
|
}
|
|
List<Integer> alreadyExtourne = new ArrayList<>(A);
|
|
for (int i = 0; i < A; i++) {
|
|
alreadyExtourne.add(i);
|
|
}
|
|
|
|
// Warmup
|
|
extournePatched(pieceNums, alreadyExtourne);
|
|
|
|
long t0 = System.nanoTime();
|
|
int r1 = extourneUnpatched(pieceNums, alreadyExtourne);
|
|
long unpatched = System.nanoTime() - t0;
|
|
|
|
t0 = System.nanoTime();
|
|
int r2 = extournePatched(pieceNums, alreadyExtourne);
|
|
long patched = System.nanoTime() - t0;
|
|
|
|
assert r1 == r2 : "Result mismatch";
|
|
assert r1 == P * 5 : "Expected " + (P * 5) + " reversed, got " + r1;
|
|
|
|
double ratio = (double) unpatched / patched;
|
|
System.out.printf(" P=%d A=%d unpatched=%dms patched=%dms ratio=%.1fx%n",
|
|
P, A, unpatched / 1_000_000, patched / 1_000_000, ratio);
|
|
assert ratio > 5.0 : "Expected >5x ratio, got " + ratio;
|
|
System.out.println(" PASS");
|
|
}
|
|
|
|
public static void main(String[] args) {
|
|
testDolibarr0001();
|
|
testDolibarr0002();
|
|
testDolibarr0003();
|
|
System.out.println("\nAll 3 Dolibarr CWE-407 tests PASSED.");
|
|
}
|
|
}
|