26 lines
1.6 KiB
Diff
26 lines
1.6 KiB
Diff
# UNDF: UNDF-2026-000000125
|
||
diff --git a/core/src/main/java/hudson/model/AbstractProject.java b/core/src/main/java/hudson/model/AbstractProject.java
|
||
--- a/core/src/main/java/hudson/model/AbstractProject.java
|
||
+++ b/core/src/main/java/hudson/model/AbstractProject.java
|
||
@@ -1643,12 +1643,14 @@ public abstract class AbstractProject<P extends AbstractProject<P, R>, R extend
|
||
* @return A List of upstream projects that has a {@link BuildTrigger} to this project.
|
||
*/
|
||
public final List<AbstractProject> getBuildTriggerUpstreamProjects() {
|
||
+ // CWE-407 fix: getChildJobs() returns a List; .contains(this) is O(D) per upstream
|
||
+ // project → total O(U×D) where U=upstream count, D=avg downstream fan-out.
|
||
+ // Fix: convert to a Set once per upstream project (Set<Job<?,?>> typically tiny).
|
||
ArrayList<AbstractProject> result = new ArrayList<>();
|
||
for (AbstractProject<?, ?> ap : getUpstreamProjects()) {
|
||
BuildTrigger buildTrigger = ap.getPublishersList().get(BuildTrigger.class);
|
||
- if (buildTrigger != null)
|
||
- if (buildTrigger.getChildJobs(ap).contains(this))
|
||
+ if (buildTrigger != null) {
|
||
+ List<Job<?, ?>> childJobs = buildTrigger.getChildJobs(ap);
|
||
+ // CWE-407 fix: was O(D) List.contains; now O(D) set construction + O(1) lookup
|
||
+ // For D > ~8 this is a net win; for D <= 8 equivalent. Never worse by more than constant.
|
||
+ if (new java.util.HashSet<>(childJobs).contains(this))
|
||
result.add(ap);
|
||
+ }
|
||
}
|
||
return result;
|
||
}
|