From 38634f0b25837ca5081c7406a5d485c388061a72 Mon Sep 17 00:00:00 2001
From: "russell@unturf.com" <russell@unturf.com>
Date: Mon, 30 Mar 2026 13:25:06 -0400
Subject: [PATCH] =?UTF-8?q?keycloak+shiro:=20CWE-407=20scan=20CLEAN=20?=
 =?UTF-8?q?=E2=80=94=20both=20use=20HashSet=20throughout=20for=20membershi?=
 =?UTF-8?q?p=20testing?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 defects/keycloak/patch/CLEAN.md | 38 +++++++++++++++++++++++++++++++++
 defects/shiro/patch/CLEAN.md    | 36 +++++++++++++++++++++++++++++++
 2 files changed, 74 insertions(+)
 create mode 100644 defects/keycloak/patch/CLEAN.md
 create mode 100644 defects/shiro/patch/CLEAN.md

diff --git a/defects/keycloak/patch/CLEAN.md b/defects/keycloak/patch/CLEAN.md
new file mode 100644
index 000000000..e8f3c03a2
--- /dev/null
+++ b/defects/keycloak/patch/CLEAN.md
@@ -0,0 +1,38 @@
+# Keycloak — CWE-407 Scan Result: CLEAN
+
+**Target:** Keycloak (Java identity/access management)
+**Source:** https://github.com/keycloak/keycloak (depth=1)
+**Date:** 2026-03-30
+**Scanner:** manual CWE-407 pattern scan
+
+## Scan Scope
+
+- `services/src/main/java/` — core services, client registration, OIDC protocol, authorization
+- `server-spi/src/main/java/` — SPI interfaces and utilities (RoleUtils, etc.)
+- `server-spi-private/src/main/java/` — authorization policy evaluation, permission resolution
+- `model/` — JPA, Infinispan cache adapters, storage layer
+- `common/` — utility classes
+
+## Keywords Searched
+
+`.contains(` on List/ArrayList, `.indexOf(`, nested loops, dedup patterns via
+List membership, `visited`/`seen` patterns using ArrayList/LinkedList.
+
+## Findings
+
+Keycloak consistently uses `HashSet` for membership testing throughout:
+- `RoleUtils.expandCompositeRoles()` — uses `Set<RoleModel> visited`
+- Infinispan cached entities (`CachedUser`, `CachedClient`, `CachedClientScope`) — all use `Set<String>` for role mappings, scopes, groups
+- `DefaultClientSessionContext` — uses `Set<ClientScopeModel>`, `Set<RoleModel>`, `Set<String>`
+- `DefaultCors` — uses `Set<String>` for allowed origins
+- `WebOriginsUtils` — uses `HashSet<String>`
+- Authorization policy evaluation (`DecisionPermissionCollector`) — uses `HashSet`/`LinkedHashSet`
+
+Minor List.contains usage found in `ProtocolMappersClientRegistrationPolicy` and
+`ClientScopesClientRegistrationPolicy` (admin client registration path), but these
+operate on small config lists (<20 items) and are not hot-path. Not reportable.
+
+## Verdict
+
+CLEAN — no CWE-407 defects found. Keycloak's codebase is well-disciplined about
+using Set data structures for membership testing.
diff --git a/defects/shiro/patch/CLEAN.md b/defects/shiro/patch/CLEAN.md
new file mode 100644
index 000000000..dcee82a41
--- /dev/null
+++ b/defects/shiro/patch/CLEAN.md
@@ -0,0 +1,36 @@
+# Apache Shiro — CWE-407 Scan Result: CLEAN
+
+**Target:** Apache Shiro (Java security framework)
+**Source:** https://github.com/apache/shiro (depth=1)
+**Date:** 2026-03-30
+**Scanner:** manual CWE-407 pattern scan
+
+## Scan Scope
+
+- `core/src/main/java/` — AuthorizingRealm, permission resolution, role checking
+- `web/src/main/java/` — filter chain management, session management
+- `event/src/main/java/` — event bus
+- `config/` — OGDL configuration
+- `lang/` — utility classes
+
+## Keywords Searched
+
+`.contains(` on List/ArrayList/Collection, `.indexOf(`, nested loops,
+dedup patterns, `visited`/`seen` patterns.
+
+## Findings
+
+Apache Shiro uses appropriate data structures throughout:
+- `AuthorizingRealm.getPermissions()` — collects into `HashSet<Permission>`
+- `AuthorizingRealm.hasRole()` — delegates to `SimpleAuthorizationInfo.getRoles()` which returns `Set<String>`
+- `WildcardPermission` — parts stored as `List<Set<String>>`, membership checks use Set.contains/containsAll
+- `DefaultEventBus.Subscription.onEvent()` — uses `HashSet<Object>` for dedup
+- `DefaultFilterChainManager` — uses `Map.keySet()` (Set) for chain name lookups
+
+The codebase is small and well-structured. All collection membership tests on
+hot paths use Set-based data structures.
+
+## Verdict
+
+CLEAN — no CWE-407 defects found. Shiro's authorization and permission resolution
+code properly uses Set data structures for membership testing.