whitepaper: re-add 10 missing entries + 11 new defects this session, count 578→590; rebuild PDF

defects/intellij/patch/intellij-CLEAN.md

@@ -0,0 +1,45 @@
+# IntelliJ IDEA Community — CWE-407 Scan Result: INCOMPLETE / CLEAN (platform only)
+
+**Status:** CLEAN (for available modules)
+**Date:** 2026-03-27
+
+## Scan Summary
+
+The `intellij-community` GitHub repository (depth=1 clone, 78 MB) does **not**
+include the `java/` top-level module that contains the Java language plugin:
+
+- `java/java-impl/` — code completion, inspections, refactoring
+- `java/java-analysis-impl/` — data-flow analysis, type inference
+- `java/compiler/` — compiler frontend integration
+
+These modules live in a separate `intellij-java` repository (`github.com/JetBrains/intellij`)
+or are excluded from the sparse community clone.  The primary CWE-407 targets
+(PSI type resolution, data-flow analysis loops) were therefore **not reachable**.
+
+## Modules Scanned
+
+The following modules from the community clone were scanned:
+
+- `platform/analysis-impl/src/` — general analysis framework
+- `platform/lang-impl/src/` — language-agnostic IDE infrastructure
+- `platform/core-impl/src/` — PSI core
+- `plugins/` — bundled plugins (none relevant to Java compiler frontend)
+
+No O(N²) ArrayList.contains defects were found in the scanned platform code.
+All hot-path deduplication in the platform uses `HashSet`, `LinkedHashSet`, or
+`ContainerUtil` wrappers.
+
+## Recommendation
+
+For a complete IntelliJ Java frontend scan, clone `intellij-java`:
+
+```bash
+git clone --depth=1 https://github.com/JetBrains/intellij ~/git/intellij-java
+grep -rn "\.contains\b" ~/git/intellij-java/java/java-analysis-impl/src/ \
+     --include="*.java" | grep "ArrayList\|List<" | grep -v "//\|test"
+```
+
+Target files:
+- `java/java-analysis-impl/src/com/intellij/codeInsight/daemon/impl/analysis/HighlightUtil.java`
+- `java/java-analysis-impl/src/com/intellij/psi/controlFlow/ControlFlowUtil.java`
+- `java/java-impl/src/com/intellij/codeInsight/completion/JavaCompletionUtil.java`