# Apache Ant — Diamond Recursion CWE-407 Scan: CLEAN

**Pattern:** Recursive cycle/reachability without visited set (O(2^D) on diamond DAGs)
**Scan date:** 2026-03-29
**Scope:** `src/main/org/apache/tools/ant/`

## Method

Searched for `isCyclic`, `hasCycle`, `createsCycle`, `addsCycle`, `willCycle`,
`isReachable`, `canReach`, `hasPath`, `detectCycle` across all Java sources.
Checked each hit for recursive traversal lacking a visited-accumulator parameter.

## Key candidate: `Project.tsort()`

`src/main/org/apache/tools/ant/Project.java` lines 1898–1939: the target dependency
topological sort passes a `Hashtable<String, String> state` through every recursive
call. State values are `VISITING`/`VISITED`. This is a proper DFS with O(1) visit
check per node — not the diamond recursion anti-pattern.

## Other candidates

| File | Method | Verdict |
|------|--------|---------|
| `Project.java` | `tsort()` | Passes `state` Hashtable — CLEAN |
| `taskdefs/optional/depend/Depend.java` | `isRmiStub()` / `isStub()` | Not recursive on a DAG — CLEAN |
| `taskdefs/condition/IsReachable.java` | Network connectivity check | Not a graph traversal — CLEAN |

## Verdict

CLEAN. No diamond recursion CWE-407 found. Ant's dependency resolution uses a
state-tracking Hashtable (equivalent to a visited set) through all recursive calls.