# Apache Beam — CWE-407 Scan Result: CLEAN

**Date:** 2026-03-30
**Target:** Apache Beam (Java SDK + Runners)
**Scope:** `sdks/java/core/src/main/java/`, `runners/*/src/main/java/`

## Summary

No CWE-407 (algorithmic complexity via linear membership test in loop) defects found.

Apache Beam consistently uses proper data structures for membership testing:
- `TransformHierarchy.visit()`: `Set<PValue>` and `Set<Node>` for visitedValues/visitedNodes
- `PortablePipelineJarCreator.copyResourcesFromJar()`: `HashSet<String>` for previousEntryNames
- `PipelineTranslation`: `HashSet<String>` for viewTransforms
- `GreedyStageFuser`: `LinkedHashSet` for fusedCollections/materializedPCollections
- `Networks.reachableNodes()`: `HashSet` for visitedNodes
- `OutputDeduplicator`: `HashMultimap` for pcollectionProducers
- `SamzaTimerInternalsFactory`: `TreeSet` for eventTimeBuffer
- `DisplayData.Builder`: `IdentityHashSet` for visitedComponents
- `FieldAccessDescriptor.union()`: `LinkedHashSet` for fieldsAccessed
- `PipelineOptionsFactory`: `ImmutableSet` for IGNORED_METHODS, PIPELINE_OPTIONS_FACTORY_CLASSES

## Keywords searched

`.contains(`, `.indexOf(`, `ArrayList`, `List<`, `visited`, `seen`, `worklist`