Apache Ant — CWE-407 Analysis
==============================

**Status: CLEAN — 0 confirmed defects**

Apache Ant's target dependency executor and class dependency analyzer were scanned.
The scanner returned 19 candidates; all are false positives on ``HashSet``-backed
collections.

Key findings:

- ``Project.java:1389`` — ``succeededTargets.contains(dependencyName)`` inside
  ``executeSortedTargets`` target dependency execution loop.
  ``succeededTargets`` is declared ``new HashSet<>()`` — O(1). FALSE POSITIVE.

- ``bcel/AncestorAnalyzer.java:99,106`` — ``!dependencies.contains(interfaceName/superClass)``
  inside BCEL class hierarchy traversal loop. ``dependencies`` is declared
  ``new HashSet<>()`` — O(1). FALSE POSITIVE.

- ``bcel/FullAnalyzer.java:108`` — same pattern, same ``HashSet`` container. FALSE POSITIVE.

- ``DependScanner.java:131`` — ``parentSet.contains(fName)``. ``parentSet`` is built via
  ``.collect(Collectors.toSet())`` — a ``HashSet``. FALSE POSITIVE.

Despite being a ~2002-era Java codebase with high prior probability of ArrayList
patterns, Ant's dependency tracking code uses modern ``HashSet`` containers throughout.
The build system correctly avoids the CWE-407 pattern.

* Scanner: ``tools/scans/ant.sh``
* Scan result: ``tools/scan-results/ant.txt`` — 19 candidates, all false positives
