# JGit — CWE-407 scan result: CLEAN

## Scan date: 2026-03-27

## Files scanned
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/revwalk/PedestrianObjectReachabilityChecker.java` — uses RevWalk with markUninteresting; no list membership in object loop
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/revwalk/BitmappedReachabilityChecker.java` — BitmapBuilder for reached set, O(1) contains; remainingTargets ArrayList but removeIf bounded by #targets, not repository scale
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/pack/PackWriter.java` — have/want are Set<? extends ObjectId> (HashSet), O(1)
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/pack/PackWriterBitmapPreparer.java` — excessiveBranches is HashSet<RevCommit>, newWants is HashSet, O(1)
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/pack/PackBitmapCalculator.java` — bitmap operations only
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/RefDirectory.java` — RefList.contains uses binary search O(log N)
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/ObjectDirectory.java` — skips is HashSet<AlternateHandle.Id>, O(1)
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/PackDirectory.java` — indexOf in remove() is single call, not inside a loop proportional to pack count
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/GC.java` — existing/objectsToKeep/seenParentIds are HashSet, O(1)
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/CachedObjectDirectory.java` — unpackedObjects is ObjectIdOwnerMap (hashmap), O(1)
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/reftable/ReftableDatabase.java` — deleted is HashSet, added is TreeSet (O(log N)), ceiling() is O(log N)
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/reftable/ReftableBatchRefUpdate.java` — checkConflicting uses TreeSet<String> added and HashSet deleted, O(log N)
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/reftable/ReftableWriter.java` — LongList.contains is O(B) where B = #blocks per OID (typically 1-3), not repository scale
- `org.eclipse.jgit/src/org/eclipse/jgit/lib/RefDatabase.java` — getConflictingNames uses allRefs.keySet() which is a Map, containsKey is O(1)
- `org.eclipse.jgit/src/org/eclipse/jgit/lib/ObjectChecker.java` — EnumSet and ObjectIdSet, O(1)
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/dfs/MidxPackFilter.java` — coveredPacksAndMidxs is HashSet, O(1)
- `org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/dfs/DfsPackCompactor.java` — packs and reftables are HashSet, O(1)

## Conclusion
No unbounded O(n²) membership defects found in the scanned JGit files.
All hot-path membership tests use hash structures (HashSet, ObjectIdOwnerMap,
ObjectIdSet, EnumSet) or sorted/binary-search structures (TreeSet, RefList).

The LongList.contains in ReftableWriter.addBlock is O(B) but B is bounded by
the number of pack file blocks containing a given OID, which is effectively
constant (1-3) in practice — not proportional to repository scale.