google / log4jscanner

A log4j vulnerability filesystem scanner and Go package for analyzing JAR files.
Apache License 2.0
1.57k stars 120 forks source link

Skip opening irrelevant class files #45

Closed singlethink closed 2 years ago

singlethink commented 2 years ago

If we're just going to ignore them, we don't need to open a zip reader for them or pull a buffer from the pool.

name              old time/op    new time/op    delta
Parse-12            64.9µs ± 4%    34.5µs ± 9%  -46.80%  (p=0.008 n=5+5)
ParseParallel-12    6.79µs ± 1%    3.10µs ± 2%  -54.37%  (p=0.008 n=5+5)

name              old alloc/op   new alloc/op   delta
Parse-12            18.1kB ± 0%     4.8kB ± 0%  -73.48%  (p=0.008 n=5+5)
ParseParallel-12    18.6kB ± 0%     5.0kB ± 0%  -73.21%  (p=0.008 n=5+5)

name              old allocs/op  new allocs/op  delta
Parse-12              54.0 ± 0%      30.0 ± 0%  -44.44%  (p=0.008 n=5+5)
ParseParallel-12      54.0 ± 0%      30.0 ± 0%  -44.44%  (p=0.008 n=5+5)
singlethink commented 2 years ago

Attempted to resolve your concerns via refactor. In the process, I identified some false negatives and one false positive. I've resolved the false positive and documented the false negatives.

singlethink commented 2 years ago

Done