32 lines
1.5 KiB
Diff
32 lines
1.5 KiB
Diff
# UNDF: UNDF-2026-000000167
|
|
--- a/impl/maven-core/src/main/java/org/apache/maven/execution/ReactorManager.java
|
|
+++ b/impl/maven-core/src/main/java/org/apache/maven/execution/ReactorManager.java
|
|
@@ -1,6 +1,7 @@
|
|
import java.time.Duration;
|
|
import java.util.ArrayList;
|
|
import java.util.HashMap;
|
|
+import java.util.HashSet;
|
|
import java.util.List;
|
|
import java.util.Map;
|
|
|
|
@@ -50,7 +50,7 @@ public class ReactorManager {
|
|
// make projects that depend on me, and projects that I depend on
|
|
public static final String MAKE_BOTH_MODE = "make-both";
|
|
|
|
- private List<String> blackList = new ArrayList<>();
|
|
+ // CWE-407 fix: use HashSet for O(1) contains() instead of ArrayList O(N).
|
|
+ // blackList(String) is called recursively over dependent projects — with an
|
|
+ // ArrayList, every contains() check is a linear scan making the recursive
|
|
+ // DFS O(N²) for N projects under cascading failure. HashSet degrades the
|
|
+ // per-check cost from O(N) to O(1), making the full cascade O(N log N) in
|
|
+ // practice and O(N) amortised.
|
|
+ private final java.util.Set<String> blackList = new HashSet<>();
|
|
|
|
@@ -96,7 +97,7 @@ public class ReactorManager {
|
|
private void blackList(String id) {
|
|
- if (!blackList.contains(id)) {
|
|
- blackList.add(id);
|
|
+ if (blackList.add(id)) {
|
|
List<String> dependents = sorter.getDependents(id);
|
|
if (dependents != null && !dependents.isEmpty()) {
|
|
for (String dependentId : dependents) {
|