# Odoo — CWE-407 Scan Result: CLEAN

**Scanned:** 2026-03-30
**Source:** https://github.com/odoo/odoo (v19.0)
**Scanner:** manual CWE-407 audit

## Summary

No CWE-407 (algorithmic complexity via linear membership test in a loop) defects found.

## Notes

Odoo's codebase is well-protected against this class of defect:

- ORM core (`odoo/orm/`) uses `set`, `frozenset`, `OrderedSet`, and `dict` consistently
  for membership tests in loops
- Recordsets implement set-based `__contains__` (O(1))
- `tools/misc.py` `unique()` helper uses `set` for dedup
- Module loading uses `dict`/`set` for loaded module tracking
- Record rules use SQL-based evaluation, not list scanning
- Field dependency tracking uses `Collector` (dict of tuples) with small per-key sizes
- Access control uses SQL queries, not list iteration

The `Collector.add()` method in `tools/misc.py` does `if val not in vals` on a tuple,
but it is only called from field setup (not a hot loop) and tuple sizes are typically 1-3.