java-topology/defects/pulsar/patch/pulsar-0003-namespaces-base-topic-hash-positions-list-contains.patch
russell@unturf.com b0a9a83efc pulsar: 3 CWE-407 defects — load-manager/replicator/namespace List.contains O(N^2)
pulsar-0001: ModularLoadManagerImpl.reapDeadBrokerPreallocations() receives
  aliveBrokers as List<String> from listLocks(); .contains() inside O(B) loop
  → O(B^2); fix: HashSet wrap before loop.
pulsar-0002: PersistentTopic.removeOrphanReplicationCursors() and
  checkReplicationStatus() call configuredClusters.contains() (List<String>)
  inside loops over cursors and replicators → O(C×R); fix: HashSet wrap.
pulsar-0003: NamespacesBase.internalGetTopicHashPositionsAsync() calls
  allTopicsInThisBundle.contains() (List<String>) inside for loop over query
  topics → O(T×B); fix: HashSet wrap before loop.

UNDF-2026-000000505 through UNDF-2026-000000507; 3/3 unit tests PASS.
2026-03-30 08:43:51 -04:00

38 lines
2.9 KiB
Diff

# UNDF: UNDF-2026-000000507
# UNDF:
--- a/pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/NamespacesBase.java
+++ b/pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/NamespacesBase.java
@@ -1530,7 +1530,8 @@ public abstract class NamespacesBase extends PulsarWebResource {
.thenApply(allTopicsInThisBundle -> {
Map<String, Long> topicHashPositions = new HashMap<>();
+ Set<String> allTopicsSet = new HashSet<>(allTopicsInThisBundle);
if (topics == null || topics.size() == 0) {
allTopicsInThisBundle.forEach(t -> {
topicHashPositions.put(t,
pulsar().getNamespaceService().getNamespaceBundleFactory()
.getLongHashCode(t));
});
} else {
for (String topic : topics.stream().map(Codec::decode).toList()) {
TopicName topicName = TopicName.get(topic);
// partitioned topic
if (topicName.getPartitionIndex() == -1) {
allTopicsInThisBundle.stream()
.filter(t -> TopicName.get(t).getPartitionedTopicName()
.equals(TopicName.get(topic).getPartitionedTopicName()))
.forEach(partition -> {
topicHashPositions.put(partition,
pulsar().getNamespaceService()
.getNamespaceBundleFactory()
.getLongHashCode(partition));
});
} else { // topic partition
- if (allTopicsInThisBundle.contains(topicName.toString())) {
+ if (allTopicsSet.contains(topicName.toString())) {
topicHashPositions.put(topic,
pulsar().getNamespaceService().getNamespaceBundleFactory()
.getLongHashCode(topic));
}
}
}
}