# dgraph — diamond recursion CWE-407 scan: CLEAN

## Scan date: 2026-03-29

## Method scanned

`SubGraph.recurse()` in `query/query.go` — recursive SubGraph traversal.

## Finding

`SubGraph.Children` and `SubGraph.Filters` are `[]*SubGraph` slices. Each SubGraph
is created from a DQL parse tree where each child has a unique parent. The structure
is a tree (parse tree), not a DAG. A single SubGraph node cannot appear as a child
of two different parents, so diamond blowup is not possible.

The existing `dgraph-0001` (shortest-path route indexOf) was already filed. No new
diamond recursion patterns were found.

## Verdict: CLEAN