# flink — diamond recursion CWE-407 scan: CLEAN

## Scan date: 2026-03-29

## Method scanned

`StreamGraphGenerator.transform()` — recursive transformation of the operator DAG.

## Finding

`StreamGraphGenerator` maintains `alreadyTransformed` (`IdentityHashMap<Transformation<?>, Collection<Integer>>`)
initialized at the start of every `generate()` call (line 260) and checked before
every recursive descent (lines 464, 598). Any node that is reached a second time
returns the cached ID set immediately.

`StreamGraphHasherV2` likewise maintains a `Set<Integer> visited` (line 81) and
marks nodes before descending.

No recursive path through the streaming job graph generator, hasher, or topology
builder was found without an adequate visited/memoization guard.

## Verdict: CLEAN
