53 lines
2.4 KiB
Diff
53 lines
2.4 KiB
Diff
--- a/impl/maven-core/src/main/java/org/apache/maven/execution/DefaultMavenExecutionRequest.java
|
|
+++ b/impl/maven-core/src/main/java/org/apache/maven/execution/DefaultMavenExecutionRequest.java
|
|
@@ -1,6 +1,8 @@
|
|
import java.util.ArrayList;
|
|
+import java.util.LinkedHashSet;
|
|
import java.util.List;
|
|
+import java.util.Set;
|
|
|
|
// ... (existing imports unchanged)
|
|
|
|
@@ -86,7 +88,12 @@ public class DefaultMavenExecutionRequest implements MavenExecutionRequest, Clon
|
|
- private List<String> pluginGroups;
|
|
+ // CWE-407 fix: replace ArrayList with LinkedHashSet for O(1) membership
|
|
+ // tests in addPluginGroup(). addPluginGroups() calls addPluginGroup() once
|
|
+ // per group, and each call did ArrayList.contains() — O(G) — giving
|
|
+ // O(G²) for G plugin groups added in batch. LinkedHashSet preserves
|
|
+ // insertion order (required for plugin-prefix lookup) and makes every
|
|
+ // contains() / add() O(1) amortised.
|
|
+ private Set<String> pluginGroups;
|
|
|
|
@@ -795,8 +802,8 @@ public class DefaultMavenExecutionRequest implements MavenExecutionRequest, Clon
|
|
@Override
|
|
public List<String> getPluginGroups() {
|
|
if (pluginGroups == null) {
|
|
- pluginGroups = new ArrayList<>();
|
|
+ pluginGroups = new LinkedHashSet<>();
|
|
}
|
|
- return pluginGroups;
|
|
+ return new ArrayList<>(pluginGroups);
|
|
}
|
|
|
|
@@ -806,8 +813,8 @@ public class DefaultMavenExecutionRequest implements MavenExecutionRequest, Clon
|
|
public MavenExecutionRequest setPluginGroups(List<String> pluginGroups) {
|
|
if (pluginGroups != null) {
|
|
- this.pluginGroups = new ArrayList<>(pluginGroups);
|
|
+ this.pluginGroups = new LinkedHashSet<>(pluginGroups);
|
|
} else {
|
|
this.pluginGroups = null;
|
|
}
|
|
|
|
@@ -817,7 +824,7 @@ public class DefaultMavenExecutionRequest implements MavenExecutionRequest, Clon
|
|
@Override
|
|
public MavenExecutionRequest addPluginGroup(String pluginGroup) {
|
|
- if (!getPluginGroups().contains(pluginGroup)) {
|
|
- getPluginGroups().add(pluginGroup);
|
|
- }
|
|
+ // pluginGroups is now a LinkedHashSet: add() is O(1) and a no-op for
|
|
+ // duplicates, replacing the previous contains()+add() pair that was
|
|
+ // O(N) per call when pluginGroups was an ArrayList.
|
|
+ if (pluginGroups == null) pluginGroups = new LinkedHashSet<>();
|
|
+ pluginGroups.add(pluginGroup);
|
|
return this;
|
|
}
|