# IntelliJ IDEA Community — Diamond Recursion CWE-407 Scan: CLEAN

**Pattern:** Recursive cycle/reachability without visited set (O(2^D) on diamond DAGs)
**Scan date:** 2026-03-29
**Scope:** `platform/`, `plugins/` (community clone — java/ modules not included)

## Method

Searched for `isCyclic`, `hasCycle`, `createsCycle`, `addsCycle`, `willCycle`,
`wouldCreateCycle`, `detectCycle`, `isReachable`, `canReach`, `hasPath` across
all Java and Kotlin sources. Examined each recursive function for missing
visited-accumulator parameters.

## Key candidates reviewed

### `CircularModuleDependenciesDetector.addingDependencyFormsCircularity()`
`platform/projectModel-impl/.../CircularModuleDependenciesDetector.java`.

Uses `GraphAlgorithms.getInstance().computeSCCGraph()` — delegates to Tarjan SCC.
Not hand-rolled recursive traversal. CLEAN.

### `SimpleCyclesIterator.findCyclesInSCG()` / `getSCCs()`
`platform/core-impl/.../graph/impl/SimpleCyclesIterator.java`.

Johnson's algorithm with `myBlocked` HashSet and `myVIndex` HashMap as visited
state. Instance fields maintained across recursive calls. CLEAN.

### `sortTopologically()` in `sortTopologically.kt`
`plugins/kotlin/base/util/.../sortTopologically.kt`.

`populateIncomingOutcomingNodesDfa()` nested function takes explicit `visited:
MutableSet<Vertex<T>>` parameter (line 53). CLEAN.

### Pipeline topological sort
`platform/build-scripts/.../pipeline/Pipeline.kt` line 296.

Uses `visited: HashSet<NodeId>` and `visiting: HashSet<NodeId>` for cycle
detection. CLEAN.

### `BindingFactory.isCyclic()`
`plugins/rareJavaRefactorings/.../resolver/BindingFactory.java` line 443.

Returns a stored `myCyclic` field — not a graph traversal. CLEAN.

### XPath `ElementProcessor.isCyclic()`
`plugins/xpath/.../xslt/util/ElementProcessor.java` line 55.

Returns stored `myIsCyclic` field set during `process()` which maintains `myHistory`
(a visited set). CLEAN.

## Verdict

CLEAN for diamond recursion pattern in available community modules. All module
dependency, cycle detection, and topological sort code uses proper visited-set
tracking (HashSet, LinkedHashSet, or instance-field maps). No unprotected
recursive DAG traversal found.
