# Keycloak — CWE-407 Scan Result: CLEAN

**Target:** Keycloak (Java identity/access management)
**Source:** https://github.com/keycloak/keycloak (depth=1)
**Date:** 2026-03-30
**Scanner:** manual CWE-407 pattern scan

## Scan Scope

- `services/src/main/java/` — core services, client registration, OIDC protocol, authorization
- `server-spi/src/main/java/` — SPI interfaces and utilities (RoleUtils, etc.)
- `server-spi-private/src/main/java/` — authorization policy evaluation, permission resolution
- `model/` — JPA, Infinispan cache adapters, storage layer
- `common/` — utility classes

## Keywords Searched

`.contains(` on List/ArrayList, `.indexOf(`, nested loops, dedup patterns via
List membership, `visited`/`seen` patterns using ArrayList/LinkedList.

## Findings

Keycloak consistently uses `HashSet` for membership testing throughout:
- `RoleUtils.expandCompositeRoles()` — uses `Set<RoleModel> visited`
- Infinispan cached entities (`CachedUser`, `CachedClient`, `CachedClientScope`) — all use `Set<String>` for role mappings, scopes, groups
- `DefaultClientSessionContext` — uses `Set<ClientScopeModel>`, `Set<RoleModel>`, `Set<String>`
- `DefaultCors` — uses `Set<String>` for allowed origins
- `WebOriginsUtils` — uses `HashSet<String>`
- Authorization policy evaluation (`DecisionPermissionCollector`) — uses `HashSet`/`LinkedHashSet`

Minor List.contains usage found in `ProtocolMappersClientRegistrationPolicy` and
`ClientScopesClientRegistrationPolicy` (admin client registration path), but these
operate on small config lists (<20 items) and are not hot-path. Not reportable.

## Verdict

CLEAN — no CWE-407 defects found. Keycloak's codebase is well-disciplined about
using Set data structures for membership testing.