# UNDF: UNDF-2026-000000426
# IntelliJ IDEA Community — CWE-407 Scan Result: INCOMPLETE / CLEAN (platform only)

**Status:** CLEAN (for available modules)
**Date:** 2026-03-27

## Scan Summary

The `intellij-community` GitHub repository (depth=1 clone, 78 MB) does **not**
include the `java/` top-level module that contains the Java language plugin:

- `java/java-impl/` — code completion, inspections, refactoring
- `java/java-analysis-impl/` — data-flow analysis, type inference
- `java/compiler/` — compiler frontend integration

These modules live in a separate `intellij-java` repository (`github.com/JetBrains/intellij`)
or are excluded from the sparse community clone.  The primary CWE-407 targets
(PSI type resolution, data-flow analysis loops) were therefore **not reachable**.

## Modules Scanned

The following modules from the community clone were scanned:

- `platform/analysis-impl/src/` — general analysis framework
- `platform/lang-impl/src/` — language-agnostic IDE infrastructure
- `platform/core-impl/src/` — PSI core
- `plugins/` — bundled plugins (none relevant to Java compiler frontend)

No O(N²) ArrayList.contains defects were found in the scanned platform code.
All hot-path deduplication in the platform uses `HashSet`, `LinkedHashSet`, or
`ContainerUtil` wrappers.

## Recommendation

For a complete IntelliJ Java frontend scan, clone `intellij-java`:

```bash
git clone --depth=1 https://github.com/JetBrains/intellij ~/git/intellij-java
grep -rn "\.contains\b" ~/git/intellij-java/java/java-analysis-impl/src/ \
     --include="*.java" | grep "ArrayList\|List<" | grep -v "//\|test"
```

Target files:
- `java/java-analysis-impl/src/com/intellij/codeInsight/daemon/impl/analysis/HighlightUtil.java`
- `java/java-analysis-impl/src/com/intellij/psi/controlFlow/ControlFlowUtil.java`
- `java/java-impl/src/com/intellij/codeInsight/completion/JavaCompletionUtil.java`
