# UNDF: UNDF-2026-000000348
## Apache Ant — CWE-407 Scan Result: CLEAN

Scanned: `src/main/org/apache/tools/ant/` (depth=1 clone, 2026-03-27)

### Patterns checked

| Location | Type | Verdict |
|----------|------|---------|
| `DirectoryScanner.processIncluded()` L1348 | `inc/exc/des.contains()` | CLEAN — lists are `VectorSet<>` (O(1) HashSet-backed `contains()`) |
| `Project.executeTargets()` | `succeededTargets.contains()` | CLEAN — `HashSet<String>` |
| `ComponentHelper` | `checkedNamespaces.contains()` | CLEAN — `HashSet<String>` |
| `AntAnalyzer.determineDependencies()` | `dependencies.contains()` | CLEAN — `HashSet<String>` |
| `Javadoc` | `addedPackages.contains()` | CLEAN — `HashSet<String>` |
| `Main.handleArg()` | `LAUNCH_COMMANDS.contains()` | CLEAN — `unmodifiableSet(HashSet)` |

### Key finding

Ant already fixed the O(N) `DirectoryScanner` `contains()` issue in **Ant 1.8.0** by
introducing `VectorSet<E>` (`src/main/org/apache/tools/ant/util/VectorSet.java`).
`VectorSet.contains()` delegates to an internal `HashSet<E>` — O(1). The class comment
says it was created precisely because the `protected` field types in `DirectoryScanner`
prevented switching to a pure `HashSet`.

No CWE-407 defects found.