Bazel — CWE-407 Analysis
=========================

.. contents:: :local:

Overview
--------

Bazel is a build tool developed by Google, used for large-scale polyglot builds. It performs
dependency graph analysis, action graph construction, and incremental build orchestration via
the Skyframe evaluation engine.

Status: **CLEAN** (scanned 2026-03-23)
---------------------------------------

No candidates found in ``lib/graph``, ``lib/skyframe``, or ``lib/packages``.

Triage Notes
------------

The scan targeted the three highest-probability directories:

- ``lib/graph/`` — Bazel's generic graph library (Digraph, DFS, topological sort)
- ``lib/skyframe/`` — Skyframe DAG evaluation engine with cycle detection
- ``lib/packages/`` — BUILD file dependency analysis

No ``ArrayList.contains``, ``List.indexOf``, or ``ImmutableList.contains`` near graph
traversal keywords in any of these directories.

Bazel's graph library (``lib/graph/``) uses ``HashSet``-backed visited sets in its DFS and
cycle detection implementations. Skyframe uses ``HashMap``-backed node state tracking.
Google's internal Java practices enforce hash-collection use for set membership — consistent
with the finding that the CWE-407 pattern is concentrated in compiler internals from the
pre-generics era, not in tools written under modern Google Java style.

References
----------

* Scan result: ``tools/scan-results/bazel.txt``
