engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/SCAN-TODO.md
russell@unturf.com eb3be81588 cura+prusaslicer: 5-MOAD scan; cura-0002 CWE-407 SettingInheritanceManager List[str] 109x, prusaslicer-0004 CWE-407 FillRectilinear queue 64x 
cura-0002: SettingInheritanceManager._settings_with_inheritance_warning is a List[str].
Queried with `in` and mutated with .append()/.remove() on every setting property change.
With S=1000 settings, each _onPropertyChanged call costs O(S). Fix: Set[str] for O(1)
membership. 109x speedup at S=1000.

prusaslicer-0004: chain_monotonic_regions() in FillRectilinear.cpp uses std::find to
search a work queue of MonotonicRegion* on every dequeue. Queue grows to O(R) regions;
10 ants each dequeue all R regions → O(10*R^2) total. Fix: std::vector<bool> in_queue
indexed by region offset for O(1) membership. 64x speedup at R=500.

prusaslicer-scan: MOADs 0002/0003/0004/0005 CLEAN (thread_local is RNG only; no
request-scoped leakage; no full credential logging; slicing is single-threaded).
2026-04-03 14:16:30 -04:00

6.8 KiB
Raw Blame History

Scan TODO — Unscanned High-Value Targets

Status: 865 UNDF, 420+ defect dirs, 34 waves complete. Rule: clone, scan, delete clone after. Keep disk under 90%.

Priority 1 — Major infrastructure not yet scanned

  • Squid (C, HTTP proxy, huge install base)
  • Sendmail (C, MTA) — sendmail-0001 MOAD-0004 CWE-312 SASL client password logged verbatim at tTd(95,5) debug level in getauth(); MOADs 0001/0002/0003/0005 CLEAN
  • PgBouncer (C, PostgreSQL connection pooler) — pgbouncer-0001 MOAD-0004 CWE-312 SCRAM verifier logged at slog_debug; pgbouncer-0002 MOAD-0001 CWE-407 find_database() O(D) linear scan per connection 100x at D=100; MOADs 0002/0003/0005 CLEAN (single-threaded libevent)
  • Suricata (C, IDS/IPS) — suricata-0001 (CWE-407 threshold SID lookup O(T×S), CWE-312 auth header logging); suricata-0002 (CWE-407 EveHttpLogJSONHeaders O(H×F=53) per tx, 53x); MOADs 0003/0005 CLEAN
  • ClamAV (C, antivirus engine) — clamav-0001 MOAD-0004 CWE-312 proxy password logged verbatim on curl failure; MOAD-0001/0002/0003/0005 CLEAN (AC trie, BM hash, mutex-protected cache)
  • Snort (C++, IDS/IPS) — snort3-0001 MOAD-0001 CWE-407 service_candidates std::find dedup O(MC) per packet in AppID ServiceDiscovery 72x at M=10000; snort3-0002 MOAD-0001 CWE-407 CHP match_tally std::find_if O(MT) per HTTP packet 48x at T=100; MOADs 0002/0003/0004/0005 CLEAN
  • WireGuard (deeper, Go userspace tools) — wireguard-go + wireguard-tools CLEAN all 5 MOADs; go uses hash map peer lookup O(1), radix trie AllowedIPs O(32/128), no key material logged, all maps mutex-protected; tools use O(N log N) sort+merge for peer sync
  • Thunderbird (C++, email client) — thunderbird-0001 through thunderbird-0006 MOAD-0001 CWE-407 (account dedup 250x, copy-service 250x, IMAP auto-sync 250x, UID-state 500x, filter headers 125x, spam whitelist 100x); thunderbird-0007 MOAD-0001 folder tree init 250x; thunderbird-0008 MOAD-0004 CWE-312 OAuth2 access_token+refresh_token logged verbatim; MOADs 0002/0003/0005 CLEAN
  • Wine (C, Windows compatibility layer) — wine-0002 MOAD-0004 CWE-312 Basic Auth username:password logged verbatim in cache_basic_authorization() TRACE; wine-0003 MOAD-0001 CWE-407 CRYPT_CheckSimpleChainForCycles O(N^2) cert comparison (developer-acknowledged) 47x at N=1000; wine-0004 MOAD-0001 CWE-407 token_find_privilege O(count*P) in AdjustTokenPrivileges/token_check_privileges 143x at N=1000; MOAD-0002/0003/0005 CLEAN

Priority 2 — ERP/Business not yet scanned

  • Dolibarr (PHP, ERP) — scanned (see prior wave)
  • Tryton (Python, ERP) — tryton-0001 (_save_values previous list O(T*P)); MOADs 0002/0003/0004/0005 CLEAN
  • xTuple PostBooks (C++/Qt ERP, scanned via openrpt public repo) — xtuple-0001 orutils missingParamList QStringList::contains O(P*M) 52x; MOADs 0002/0003/0004/0005 CLEAN
  • SuiteCRM (PHP, CRM) — 6 defects: suitecrm-0001..0004 (prior scan), suitecrm-0005 ProjectTask getAllSubProjectTasks O(T²·P) 70x, suitecrm-0006 LuceneSearch parseHits O(H·M) 8x; MOADs 0002/0003/0004/0005 CLEAN
  • InvoiceNinja (PHP, invoicing) — 5 defects total: invoiceninja-0001 S3Cleanup O(N²) in_array; invoiceninja-0002 MOAD-0004 CheckoutCom webhook CWE-312; invoiceninja-0003 MOAD-0002 App::setLocale intertangle; invoiceninja-0004 MOAD-0001 SettingsSaver string_casts O(C×S) 4.7x; invoiceninja-0005 MOAD-0004 CBAPowerBoard vault_token CWE-312; MOAD-0003/0005 CLEAN

Priority 3 — Collaboration/Chat

  • Rocket.Chat (deeper, TypeScript) — 0003 MOAD-0001 video-conf endDirectCall O(S*U); 0004 MOAD-0004 CWE-312 OAuth secrets logged; MOAD-0002/0003/0005 CLEAN
  • Zulip (deeper, Python) — 3 MOAD-0001 defects: user_groups.py lock_subgroups O(GF), update_user_group O(DF), actions/user_groups.py full_member_group_user_ids O(M*F); MOAD-0002/0003/0004/0005 CLEAN
  • Jitsi Meet (Java/TypeScript)
  • Matrix Dendrite (Go, alt homeserver — already in defects/)
  • Mattermost (deeper, Go)

Priority 4 — Desktop apps

  • Pidgin/Finch (C, chat client) — pidgin-0001 CWE-407 499.5x, pidgin-0002 CWE-312
  • HexChat (C, IRC client)
  • Evolution (C, email/calendar)
  • Thunderbird (C++, email) — see Priority 1 entry above; 8 defects total
  • Calibre (deeper, Python ebook manager) — calibre-0003 MOAD-0001 CWE-407 depth_first flat.index() O(L*F) 38x at F=500; calibre-0004 MOAD-0001 CWE-407 HTMLFile.find_links list dedup O(L^2) 124x at L=1000; MOADs 0002/0003/0004/0005 CLEAN
  • Okular/Evince/Zathura (PDF viewers)
  • OpenSCAD (C++, parametric CAD) — openscad-0001 MOAD-0001 CWE-407 export_amf add_vertex O(V^2) ~85x at V=1000; openscad-0002 MOAD-0001 CWE-407 PolySetBuilder color dedup O(F*C) 69x at F=10000; openscad-0003 MOAD-0004 CWE-312 OctoPrint requestApiKey logs app_token verbatim; MOADs 0002/0003/0005 CLEAN
  • Solvespace (C++, parametric CAD)
  • Cura / PrusaSlicer (C++/Python, 3D printing slicers) — cura-0001 MOAD-0001 CompatibleMachineModel list rebuild O(P^2) LOW-MEDIUM; cura-0002 MOAD-0001 SettingInheritanceManager List[str] membership O(S) per property change HIGH 109x; prusaslicer-0001/0002/0003 MOAD-0001 (pre-existing); prusaslicer-0004 MOAD-0001 FillRectilinear queue O(R^2) std::find 64x; MOADs 0002/0003/0004/0005 CLEAN both targets

Priority 5 — AI/ML new wave

  • Ollama (Go, local LLM runtime)
  • LangChain (Python, LLM orchestration)
  • Hugging Face Transformers (Python)
  • vLLM (Python/C++, LLM serving)
  • llama.cpp (C++, already deleted clone, re-clone to scan)

Priority 6 — Scientific/Data

  • OpenFOAM (C++, CFD simulation)
  • ROOT (C++, CERN data analysis)
  • Scilab (C/Fortran, numerical computation)
  • Octave (deeper, C++)
  • R (deeper, C)
  • Julia (deeper)

Priority 7 — Emulators/Retro

  • PCSX2 (C++, PS2 emulator)
  • RPCS3 (C++, PS3 emulator)
  • PPSSPP (C++, PSP emulator)
  • DOSBox-X (C++, DOS emulator)

Priority 8 — Networking/Infra

  • Spamhaus tooling: rbldnsd (C, DNS blocklist server) CLEAN all 5 MOADs; dnsdbq (C, pDNS CLI) dnsdbq-0001 MOAD-0004 CWE-312 API key logged verbatim in debug mode; pdns-logger CLEAN; rdap (Go library) CLEAN
  • Forgejo (Go, Gitea fork)
  • Woodpecker CI (Go)
  • Drone CI (Go)
  • Gitea (deeper)
  • Wekan (Meteor/JS, kanban board) — wekan-0003 MOAD-0001 wekanCreator member dedup O(M^2)/O(C*M^2); MOAD-0002/0003/0004/0005 CLEAN
  • Taiga (Python, project management)
  • Redmine (Ruby, project management)

Priority 9 — IoT/Embedded

  • Zephyr RTOS (C)
  • FreeRTOS (C)
  • Contiki-NG (C)
  • ESP-IDF (C)
  • TinyGo (Go)

Already scanned CLEAN (no need to rescan)

Odoo, Beam, Krita, Hive (pre-existing only), Keycloak, Shiro, Netdata, etcd, GCC, Rust compiler, ScyllaDB, qBittorrent, Transmission, pygame, MPD, Rhythmbox, MAME, Dolphin, ScummVM, Nextcloud, Gitea, mpv, Metabase, Emacs, HandBrake, Kubernetes (MOAD-5)