keycloak+shiro: CWE-407 scan CLEAN — both use HashSet throughout for membership testing

defects/shiro/patch/CLEAN.md

@@ -0,0 +1,36 @@
+# Apache Shiro — CWE-407 Scan Result: CLEAN
+
+**Target:** Apache Shiro (Java security framework)
+**Source:** https://github.com/apache/shiro (depth=1)
+**Date:** 2026-03-30
+**Scanner:** manual CWE-407 pattern scan
+
+## Scan Scope
+
+- `core/src/main/java/` — AuthorizingRealm, permission resolution, role checking
+- `web/src/main/java/` — filter chain management, session management
+- `event/src/main/java/` — event bus
+- `config/` — OGDL configuration
+- `lang/` — utility classes
+
+## Keywords Searched
+
+`.contains(` on List/ArrayList/Collection, `.indexOf(`, nested loops,
+dedup patterns, `visited`/`seen` patterns.
+
+## Findings
+
+Apache Shiro uses appropriate data structures throughout:
+- `AuthorizingRealm.getPermissions()` — collects into `HashSet<Permission>`
+- `AuthorizingRealm.hasRole()` — delegates to `SimpleAuthorizationInfo.getRoles()` which returns `Set<String>`
+- `WildcardPermission` — parts stored as `List<Set<String>>`, membership checks use Set.contains/containsAll
+- `DefaultEventBus.Subscription.onEvent()` — uses `HashSet<Object>` for dedup
+- `DefaultFilterChainManager` — uses `Map.keySet()` (Set) for chain name lookups
+
+The codebase is small and well-structured. All collection membership tests on
+hot paths use Set-based data structures.
+
+## Verdict
+
+CLEAN — no CWE-407 defects found. Shiro's authorization and permission resolution
+code properly uses Set data structures for membership testing.