java-topology/docs/tickets/synapse-0001-server-notices-referenced-events-list-remove.md

synapse-0001: CWE-407 in synapse — server_notices referenced_events List.remove in loop

Severity: MEDIUM File: synapse/server_notices/resource_limits_server_notices.py:204 Pattern:

referenced_events: List[str] = []
if pinned_state_event is not None:
    referenced_events = list(pinned_state_event.content.get("pinned", []))

events = await self._store.get_events(referenced_events)
for event_id, event in events.items():            # O(n) loop
    if event.type != EventTypes.Message:
        continue
    if event.content.get("msgtype") == ServerNoticeMsgType:
        currently_blocked = True
        if event_id in referenced_events:         # O(n) scan
            referenced_events.remove(event.event_id)  # O(n) remove (shifts list)

Complexity: O(N²) — list.remove() is O(n) called inside O(n) iteration over events Fix: Convert referenced_events to a set before the loop for O(1) membership tests and O(1) discard Speedup: 10–100× (linear vs quadratic at N=100–1000 pinned events) Hot path: _is_room_currently_blocked() — called on every server notice delivery