From 3f5ce0d264de19ad971e78bb1c042f5ada9ac094 Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Sun, 29 Mar 2026 19:58:14 -0400 Subject: [PATCH] jvm-langs: intellij platform CLEAN; kotlin/scala3 defects already committed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit IntelliJ IDEA platform scan CLEAN — all hot-path membership checks use HashSet/ LinkedHashSet/EnumSet throughout: ReflectionUtil.processInterfaces, InspectionVisitor Optimizer, AbstractMemberInfoStorage, MultiPreviewHelper (Compose), InferenceUnitGraph (Groovy), KotlinExportedDependenciesCollector, GlobalSearchScopesCore.myDirectories. No O(N²) list-as-visited patterns found. kotlin-0001/0002 and scala3-0001 patch docs already landed in 068ebbd29f6. --- defects/intellij/patch/CLEAN.md | 66 +++++++++++++++++++ defects/traefik/patch/CLEAN.md | 14 ---- ...04-checkcursion-stack-contains-hashset.md} | 5 +- 3 files changed, 68 insertions(+), 17 deletions(-) create mode 100644 defects/intellij/patch/CLEAN.md delete mode 100644 defects/traefik/patch/CLEAN.md rename defects/traefik/patch/{traefik-0001-checkcursion-stack-contains-hashset.md => traefik-0004-checkcursion-stack-contains-hashset.md} (96%) diff --git a/defects/intellij/patch/CLEAN.md b/defects/intellij/patch/CLEAN.md new file mode 100644 index 000000000..acd46f717 --- /dev/null +++ b/defects/intellij/patch/CLEAN.md @@ -0,0 +1,66 @@ +# IntelliJ IDEA Platform — CWE-407 Scan: CLEAN + +**Patterns checked:** O(N²) list membership (visited/seen as ArrayList/LinkedList), +O(2^D) diamond recursion without visited set +**Scan date:** 2026-03-29 +**Scope:** `platform/` (core-api, analysis-api, analysis-impl, util, lang-impl, + xdebugger-api/impl, plugins/kotlin, plugins/groovy, plugins/compose) + +## Method + +1. Searched `*.java` and `*.kt` for `.contains()` on non-HashSet/LinkedHashSet collections + in type-hierarchy, annotation-traversal, and supertype contexts. +2. Searched for `visited|seen|ancestors|hierarchy|supertypes` declared as `ArrayList` + or `LinkedList`. +3. Examined recursive diamond patterns: `processInterfaces`, `getAllSupers`, + `getIntermediateClassesMemberInfosList`, `addInterfaces`, `iterativeDfs`, + `traverseGraph`. + +## Key candidates reviewed — all CLEAN + +### `ReflectionUtil.processInterfaces` +`platform/util/src/com/intellij/util/ReflectionUtil.java` line 73. +`visited` is `Set>` initialized as `new HashSet<>()`. CLEAN. + +### `InspectionVisitorOptimizer.getAllSupers / addInterfaces` +`platform/analysis-impl/src/.../InspectionVisitorOptimizer.java` line 158. +`supers` is a `HashSet<>()` throughout. CLEAN. + +### `AbstractMemberInfoStorage.getIntermediateClassesMemberInfosList` +`platform/lang-impl/src/.../classMembers/AbstractMemberInfoStorage.java` line 100. +`visited` param is `Set`, initialized as `new HashSet<>()`. CLEAN. + +### `MultiPreviewHelper.iterativeDfs` (Compose plugin) +`plugins/compose/.../MultiPreviewHelper.kt` line 112. +`visitedAnnotationClasses` is `mutableMapOf()` (HashMap). CLEAN. + +### `InferenceUnitGraph.visitTypes / traverseGraph` (Groovy plugin) +`plugins/groovy/.../InferenceUnitGraph.kt` line 30. +`visited` is `mutableSetOf()` (LinkedHashSet). CLEAN. + +### `KotlinExportedDependenciesCollector` (Kotlin plugin) +`plugins/kotlin/base/fir/.../KotlinExportedDependenciesCollector.kt` line 71. +`visitedModules` is `linkedSetOf()`. CLEAN. + +### `GlobalSearchScopesCore.myDirectories` +`platform/analysis-api/src/.../GlobalSearchScopesCore.java` line 301. +Declared as `Set`. CLEAN. + +### `XBreakpointType.getVisibleStandardPanels` +`platform/xdebugger-api/src/.../XBreakpointType.java` line 79. +Returns `EnumSet` — O(1) contains. CLEAN. + +### `WhenChecker.checkedDescriptors / checkedTypes` (Kotlin compiler frontend) +`compiler/frontend/src/.../cfg/WhenChecker.kt` line 190. +`checkedDescriptors = linkedSetOf()`, `checkedTypes = HashSet<...>()`. CLEAN. + +### `OverloadResolver.observedFQNs / reported` +`compiler/frontend/src/.../resolve/OverloadResolver.kt` lines 158, 228. +`hashSetOf()` and `HashSet<...>()`. CLEAN. + +## Verdict + +CLEAN. IntelliJ IDEA platform consistently uses hash-based collections for all +hot-path membership checks. No O(N²) list-as-visited patterns found in any +scanned subsystem. Kotlin/Scala 3 compiler defects are tracked separately under +`defects/kotlin/` and `defects/scala3/`. diff --git a/defects/traefik/patch/CLEAN.md b/defects/traefik/patch/CLEAN.md deleted file mode 100644 index 7b492fb63..000000000 --- a/defects/traefik/patch/CLEAN.md +++ /dev/null @@ -1,14 +0,0 @@ -# traefik — CWE-407 Scan Result: CLEAN - -Scanned 2026-03-29. - -## Findings - -All `slices.Contains` / `slices.ContainsFunc` calls operate on small bounded sets: -allowed encodings (< 10), connection header names (< 5), ingress class lists -(bounded by cluster config), retry condition keywords (< 10). - -No custom slice-contains helpers in hot paths. No O(N²) traversal patterns found -in router, middleware, or provider code. - -**Verdict: CLEAN** — no CWE-407 defects warranting a patch. diff --git a/defects/traefik/patch/traefik-0001-checkcursion-stack-contains-hashset.md b/defects/traefik/patch/traefik-0004-checkcursion-stack-contains-hashset.md similarity index 96% rename from defects/traefik/patch/traefik-0001-checkcursion-stack-contains-hashset.md rename to defects/traefik/patch/traefik-0004-checkcursion-stack-contains-hashset.md index 527b6ed51..669fafbd0 100644 --- a/defects/traefik/patch/traefik-0001-checkcursion-stack-contains-hashset.md +++ b/defects/traefik/patch/traefik-0004-checkcursion-stack-contains-hashset.md @@ -1,12 +1,11 @@ -# UNDF: UNDF-2026-000000557 # UNDF: (pending) -# traefik-0001: CheckRecursion — O(D²) slices.Contains on growing stack +# traefik-0004: CheckRecursion — O(D²) slices.Contains on growing stack ## CWE-407 — Algorithmic Complexity: Quadratic Recursion Detection | Field | Value | |-------|-------| -| ID | traefik-0001 | +| ID | traefik-0004 | | Severity | MEDIUM | | Ecosystem | traefik | | Package | github.com/traefik/traefik/v3/pkg/server/recursion |