# mybatis-3 diamond recursion scan — CLEAN

Scanned: 2026-03-29
Scope: diamond recursion / CWE-407 in ORM dependency graph traversal

## Files checked

- `src/main/java/org/apache/ibatis/session/` — no graph traversal with cycle risk.
- `src/main/java/org/apache/ibatis/parsing/` — XML parsing, no graph topology.
- `src/main/java/org/apache/ibatis/executor/resultset/DefaultResultSetHandler.java` —
  uses `Set`/`Map.containsKey()` for O(1) lookups in result mapping.
- `src/main/java/org/apache/ibatis/cache/decorators/` — FIFO/LRU cycle is a ring
  buffer rotation, not a graph cycle detection problem.

## Verdict

CLEAN. MyBatis has no graph dependency ordering code in the migration/schema tool
category. Result set mapping uses proper Set-based dedup.
