keycloak+shiro: CWE-407 scan CLEAN — both use HashSet throughout for membership testing

defects/keycloak/patch/CLEAN.md

@@ -0,0 +1,38 @@
+# Keycloak — CWE-407 Scan Result: CLEAN
+
+**Target:** Keycloak (Java identity/access management)
+**Source:** https://github.com/keycloak/keycloak (depth=1)
+**Date:** 2026-03-30
+**Scanner:** manual CWE-407 pattern scan
+
+## Scan Scope
+
+- `services/src/main/java/` — core services, client registration, OIDC protocol, authorization
+- `server-spi/src/main/java/` — SPI interfaces and utilities (RoleUtils, etc.)
+- `server-spi-private/src/main/java/` — authorization policy evaluation, permission resolution
+- `model/` — JPA, Infinispan cache adapters, storage layer
+- `common/` — utility classes
+
+## Keywords Searched
+
+`.contains(` on List/ArrayList, `.indexOf(`, nested loops, dedup patterns via
+List membership, `visited`/`seen` patterns using ArrayList/LinkedList.
+
+## Findings
+
+Keycloak consistently uses `HashSet` for membership testing throughout:
+- `RoleUtils.expandCompositeRoles()` — uses `Set<RoleModel> visited`
+- Infinispan cached entities (`CachedUser`, `CachedClient`, `CachedClientScope`) — all use `Set<String>` for role mappings, scopes, groups
+- `DefaultClientSessionContext` — uses `Set<ClientScopeModel>`, `Set<RoleModel>`, `Set<String>`
+- `DefaultCors` — uses `Set<String>` for allowed origins
+- `WebOriginsUtils` — uses `HashSet<String>`
+- Authorization policy evaluation (`DecisionPermissionCollector`) — uses `HashSet`/`LinkedHashSet`
+
+Minor List.contains usage found in `ProtocolMappersClientRegistrationPolicy` and
+`ClientScopesClientRegistrationPolicy` (admin client registration path), but these
+operate on small config lists (<20 items) and are not hot-path. Not reportable.
+
+## Verdict
+
+CLEAN — no CWE-407 defects found. Keycloak's codebase is well-disciplined about
+using Set data structures for membership testing.

defects/shiro/patch/CLEAN.md

@@ -0,0 +1,36 @@
+# Apache Shiro — CWE-407 Scan Result: CLEAN
+
+**Target:** Apache Shiro (Java security framework)
+**Source:** https://github.com/apache/shiro (depth=1)
+**Date:** 2026-03-30
+**Scanner:** manual CWE-407 pattern scan
+
+## Scan Scope
+
+- `core/src/main/java/` — AuthorizingRealm, permission resolution, role checking
+- `web/src/main/java/` — filter chain management, session management
+- `event/src/main/java/` — event bus
+- `config/` — OGDL configuration
+- `lang/` — utility classes
+
+## Keywords Searched
+
+`.contains(` on List/ArrayList/Collection, `.indexOf(`, nested loops,
+dedup patterns, `visited`/`seen` patterns.
+
+## Findings
+
+Apache Shiro uses appropriate data structures throughout:
+- `AuthorizingRealm.getPermissions()` — collects into `HashSet<Permission>`
+- `AuthorizingRealm.hasRole()` — delegates to `SimpleAuthorizationInfo.getRoles()` which returns `Set<String>`
+- `WildcardPermission` — parts stored as `List<Set<String>>`, membership checks use Set.contains/containsAll
+- `DefaultEventBus.Subscription.onEvent()` — uses `HashSet<Object>` for dedup
+- `DefaultFilterChainManager` — uses `Map.keySet()` (Set) for chain name lookups
+
+The codebase is small and well-structured. All collection membership tests on
+hot paths use Set-based data structures.
+
+## Verdict
+
+CLEAN — no CWE-407 defects found. Shiro's authorization and permission resolution
+code properly uses Set data structures for membership testing.