wave17: openssh-0001/2, strongswan-0001, gradle-0002, groovy-0001/2, make-0001, clojure-CLEAN + whitepaper 549/240

defects/clojure/patch/clojure-CLEAN.md

@@ -0,0 +1,43 @@
+# Clojure Compiler — CWE-407 Scan Result: CLEAN
+
+## Files Scanned
+
+- `src/jvm/clojure/lang/Compiler.java` (9679 lines)
+- `src/jvm/clojure/lang/RT.java` (2414 lines)
+- `src/jvm/clojure/lang/Namespace.java` (277 lines)
+- `src/jvm/clojure/lang/Reflector.java` (709 lines)
+
+## Verdict
+
+**CLEAN** — No CWE-407 defects found.
+
+## Evidence
+
+Clojure's compiler is architecturally immune to this class of defect because
+it consistently uses **persistent hash data structures** from `clojure.lang`
+for all membership and deduplication operations:
+
+| Variable | Type | Membership | Complexity |
+|---|---|---|---|
+| `usedConstants` | `IPersistentSet` (PersistentHashSet) | `.contains(i)` | O(1) |
+| `letFnLocals` | `IPersistentSet` | `.contains(lb)` | O(1) |
+| `localsUsedInCatchFinally` | `PersistentHashSet` | `.contains(i)` | O(1) |
+| `constantKeys` (MapExpr) | `PersistentHashSet` | `.contains(kval)` | O(1) |
+| `AFN_FIS` (FISupport) | `IPersistentSet` | `.contains(target)` | O(1) |
+| `OBJECT_METHODS` (FISupport) | `IPersistentSet` | `.contains(method.getName())` | O(1) |
+| Namespace `mappings` | `IPersistentMap` | `.containsKey(sym)` | O(1) |
+| Namespace `aliases` | `IPersistentMap` | `.containsKey(alias)` | O(1) |
+
+The `ArrayList` instances that appear (`params`, `rets`, `methods` in
+`MethodExpr` and `StaticMethodExpr`) are used only for index-based access,
+not for membership queries in hot paths.
+
+`Reflector.getMethods` returns a list that is then passed to `matchMethod`,
+which iterates once in O(M) — this is single-pass, not nested.
+
+`RT.java` uses `IPersistentMap`/`IPersistentSet` for all namespace and type
+lookups — all O(1).
+
+## Date
+
+2026-03-27