java-topology/defects/peewee/unit/test_peewee_cwe407.py

"""
CWE-407 unit tests for Peewee.

peewee-0001: _SortedFieldList.index() list.index() → bisect_left
  File: peewee.py lines 6129-6130
  Pattern: self._keys.index(field._sort_key) does O(n) linear scan of a
  sorted list when bisect_left gives O(log n).
  Called from remove() which is called from remove_field() (schema mutation).
"""

import time
from bisect import bisect_left, bisect_right, insort


# ---------------------------------------------------------------------------
# Reproduce _SortedFieldList with defective and fixed index()
# ---------------------------------------------------------------------------

class _SortedFieldListDefective:
    """Original implementation with O(n) index()."""

    def __init__(self):
        self._keys = []
        self._items = []

    def __contains__(self, item):
        k = item[1]  # _sort_key is item[1] in our test tuples
        i = bisect_left(self._keys, k)
        j = bisect_right(self._keys, k)
        return item in self._items[i:j]

    def index(self, field):
        # DEFECTIVE: O(n) linear scan
        return self._keys.index(field[1])

    def insert(self, item):
        k = item[1]
        i = bisect_left(self._keys, k)
        self._keys.insert(i, k)
        self._items.insert(i, item)

    def remove(self, item):
        idx = self.index(item)
        del self._items[idx]
        del self._keys[idx]


class _SortedFieldListFixed:
    """Fixed implementation with O(log n) index()."""

    def __init__(self):
        self._keys = []
        self._items = []

    def __contains__(self, item):
        k = item[1]
        i = bisect_left(self._keys, k)
        j = bisect_right(self._keys, k)
        return item in self._items[i:j]

    def index(self, field):
        # FIXED: O(log n) bisect lookup
        k = field[1]
        return bisect_left(self._keys, k)

    def insert(self, item):
        k = item[1]
        i = bisect_left(self._keys, k)
        self._keys.insert(i, k)
        self._items.insert(i, item)

    def remove(self, item):
        idx = self.index(item)
        del self._items[idx]
        del self._keys[idx]


def _make_fields(n):
    """Return a list of (name, sort_key) tuples simulating Field objects."""
    return [(f"field_{i}", (2, i)) for i in range(n)]


def test_sorted_field_list_index_defective_is_slower():
    """O(n) list.index() must be measurably slower than O(log n) bisect at scale."""
    n = 2000  # large model with many fields

    fields = _make_fields(n)

    defective = _SortedFieldListDefective()
    fixed_impl = _SortedFieldListFixed()
    for f in fields:
        defective.insert(f)
        fixed_impl.insert(f)

    # Time: index() calls across all n fields
    t0 = time.perf_counter()
    for _ in range(50):
        for f in fields:
            defective.index(f)
    defective_time = time.perf_counter() - t0

    t0 = time.perf_counter()
    for _ in range(50):
        for f in fields:
            fixed_impl.index(f)
    fixed_time = time.perf_counter() - t0

    ratio = defective_time / fixed_time
    assert ratio >= 5, (
        f"Expected defective to be >=5x slower at n={n}, "
        f"got ratio={ratio:.1f} "
        f"(defective={defective_time:.3f}s, fixed={fixed_time:.3f}s)"
    )


def test_sorted_field_list_remove_correctness():
    """remove() must produce identical results for defective and fixed impls."""
    import random
    random.seed(42)

    for n in [5, 20, 100]:
        fields = _make_fields(n)

        defective = _SortedFieldListDefective()
        fixed_impl = _SortedFieldListFixed()
        for f in fields:
            defective.insert(f)
            fixed_impl.insert(f)

        # Remove half the fields in random order
        to_remove = random.sample(fields, n // 2)
        for f in to_remove:
            defective.remove(f)
            fixed_impl.remove(f)

        assert list(defective._items) == list(fixed_impl._items), (
            f"Items differ after remove at n={n}: "
            f"defective={defective._items} fixed={fixed_impl._items}"
        )
        assert list(defective._keys) == list(fixed_impl._keys), (
            f"Keys differ after remove at n={n}"
        )


def test_sorted_field_list_index_returns_correct_position():
    """Fixed index() must return the same position as the original for all fields."""
    fields = _make_fields(100)

    defective = _SortedFieldListDefective()
    fixed_impl = _SortedFieldListFixed()
    for f in fields:
        defective.insert(f)
        fixed_impl.insert(f)

    for f in fields:
        d_idx = defective.index(f)
        f_idx = fixed_impl.index(f)
        assert d_idx == f_idx, (
            f"index mismatch for {f}: defective={d_idx} fixed={f_idx}"
        )


if __name__ == "__main__":
    test_sorted_field_list_index_defective_is_slower()
    print("peewee-0001 performance PASS")
    test_sorted_field_list_remove_correctness()
    print("peewee-0001 correctness PASS")
    test_sorted_field_list_index_returns_correct_position()
    print("peewee-0001 index position PASS")