# pydantic: CLEAN

CWE-407 scan: 2026-03-30

Source: https://github.com/pydantic/pydantic (depth=1, v2.13.0b3)

## Scan scope

- `pydantic/` and `pydantic/_internal/` — Python source
- Focus: field validator dedup, model field membership, schema generation visited set, discriminator scanning
- Keywords: `in list`, `.index(`, nested for loops

## Findings

No CWE-407 defects found.

- `_internal/_decorators.py:489-497` — duplicate field serializer check uses `seen: set[str]` — correct O(1)
- `_internal/_generate_schema.py:2877-2885` — circular reference detection uses `visited: set[str]` — correct O(1)
- `_internal/_generate_schema.py:231` — converts `fields` to `set()` before membership test — correct O(1)
- `_internal/_utils.py:151-170` — `unique_list()` has O(N^2) pattern with list `.index()` + `not in`,
  but this function is **dead code in v2** (only called from `v1/main.py` compat layer, not imported by v2)
- Discriminated union handling uses dict-based lookups throughout
- Schema generation uses proper set-based visited tracking

## Verdict

CLEAN — pydantic v2 uses sets/dicts appropriately for all membership tests in hot paths.
The only O(N^2) function (`unique_list`) is dead code in v2.
