sqlass ResidentFilter Quadratic CPU Exhaustion Fix

Vulnerability Overview This commit ( ) fixes a vulnerability in the library's where CPU consumption grows quadratically. Problem Description: rebuilds the statement prefix from the beginning of the statement on every call, causing CPU consumption to grow O(N²) with the number of tokens. An attacker can construct a SQL statement containing a large number of tokens (such as or clauses), causing and to repeatedly traverse the entire prefix, resulting in CPU exhaustion (DoS). With the threshold , statements exceeding this threshold trigger the grouping token limit, but even when the threshold is not exceeded, long statements still lead to significant performance degradation. Affected Scope Affected Components: The class in the library ( ) Trigger Condition: Attacker-controlled SQL statements containing a large number of tokens (e.g., long lists or lists) Impact: CPU consumption grows quadratically with the number of tokens, which can cause slow service response or CPU exhaustion (DoS) Fixed Version: This commit modifies to traverse via linearly, reducing the complexity from O(N²) to O(N) Fix Details Core Changes ( ): 1. New method: Traverses tokens linearly via to calculate the starting offset of the current line, avoiding rebuilding the prefix from the start on every call. 2. Modified method: Changed from the original O(N²) rebuild logic to call to obtain the line start position and then calculate the offset, reducing complexity to O(N). 3. New benchmark test ( ): Validates the performance difference before and after the fix, confirming that CPU consumption has been reduced from quadratic to linear. Key Code Changes: Benchmark Test Code ( ): Summary

Goal Reached Thanks to every supporter — we hit 100%!

sqlass ResidentFilter Quadratic CPU Exhaustion Fix

More from this source