# CWE-407 Scan — gorm (Go ORM)

**Result: CLEAN**
**Date: 2026-03-30**
**Repo:** https://github.com/go-gorm/gorm (depth=1)

## Scan Summary

Scanned gorm for O(N²) list membership patterns across: schema parsing, migrator,
callbacks (query, preload, associations, create, update, delete), clause building,
and utility functions.

## Findings

No CWE-407 defects found.

### Key paths examined

| Path | Pattern | Verdict |
|------|---------|---------|
| `migrator.ReorderModels()` | Dedup via `orderedModelNamesMap = map[string]bool{}` | CLEAN |
| `schema/schema.go` | Field lookups via `FieldsByName`, `FieldsByDBName` maps | CLEAN |
| `utils.Contains()` | Linear scan, but only called on small config slices (CreateClauses, etc.) | CLEAN |
| `callbacks/preload.go` | Identity maps using `utils.ToStringKey()` as map key | CLEAN |
| `callbacks/associations.go` | `cacheKey` map for relationship value dedup | CLEAN |
| `schema/field.go` | `TagSettings map[string]string` — O(1) tag lookup | CLEAN |

### Why gorm is clean

The migrator's topology sort (`ReorderModels`) uses a `map[string]bool` for
visited tracking — O(1) per lookup, O(V) total. Schema field and relationship
lookups use pre-built maps. The `utils.Contains` helper is only called on
small, configuration-time string slices (typically 1–3 elements: RETURNING clauses).
No accumulating visited-list inside an outer loop was found.