# UNDF: UNDF-2026-000000107
# Hibernate ORM — Deeper CWE-407 Scan CLEAN Report

## Scan Date
2026-03-27

## Areas Scanned (beyond hibernate-0001 through hibernate-0006)

| Area | Files Scanned | Finding |
|------|---------------|---------|
| `hibernate-core` NaturalIdResolutionsImpl | invalidNaturalIdList.contains() — single lookup per entity, not in outer loop | CLEAN |
| `hibernate-core` SemanticQueryBuilder | enumTypes.contains(), JPA_STANDARD_FUNCTIONS.contains() — both are Set<> | CLEAN |
| `hibernate-core` BaseSqmToSqlAstConverter | entityNameUsesSet, visitedAssociationKeys — all Set<> types | CLEAN |
| `hibernate-core` SqmCteStatement | cteTable.getAttributes().contains() — validation-only, exception path, tiny N | BELOW THRESHOLD |
| `hibernate-core` InFlightMetadataCollectorImpl (defaultNamed*) | All HashSet<String> — O(1) contains | CLEAN |
| `hibernate-core` InFlightMetadataCollectorImpl (orderedFkSecondPasses) | Already covered by hibernate-0004 | SKIP |
| `hibernate-core` AnnotationMetadataSourceProcessorImpl (orderHierarchy) | Already covered by hibernate-0005 | SKIP |
| `hibernate-core` sql/Template | All contains() on static final Set fields | CLEAN |
| `hibernate-core` sql/ast | All contains() on Set<> typed fields | CLEAN |
| `hibernate-core` query/hql/SemanticQueryBuilder | Set<> for all hot lookups | CLEAN |
| `hibernate-core` mapping/PersistentClass.containsColumn() | getSelectables().contains() in O(D) declaredProperties loop, called from isDefinedOnMultipleSubclasses() — O(D×S) but subclass-specific, not N² on entity count | BELOW THRESHOLD |
| `hibernate-core` mapping/Constraint, ForeignKey, Index | Already covered by hibernate-0001/0002/0003 | SKIP |

## Confirmed New Defects This Session
- **hibernate-0006**: `AbstractEntityPersister` subclass alias closure O(T²) — patched

## Summary
Hibernate ORM scan is comprehensive through hibernate-0006. The remaining contains() calls
are on properly-typed Set/HashSet/LinkedHashSet fields or are in low-frequency validation paths
with trivially small N. No further HIGH/MEDIUM defects found beyond what has been reported.
