# Apache Shiro — CWE-407 Scan Result: CLEAN

**Target:** Apache Shiro (Java security framework)
**Source:** https://github.com/apache/shiro (depth=1)
**Date:** 2026-03-30
**Scanner:** manual CWE-407 pattern scan

## Scan Scope

- `core/src/main/java/` — AuthorizingRealm, permission resolution, role checking
- `web/src/main/java/` — filter chain management, session management
- `event/src/main/java/` — event bus
- `config/` — OGDL configuration
- `lang/` — utility classes

## Keywords Searched

`.contains(` on List/ArrayList/Collection, `.indexOf(`, nested loops,
dedup patterns, `visited`/`seen` patterns.

## Findings

Apache Shiro uses appropriate data structures throughout:
- `AuthorizingRealm.getPermissions()` — collects into `HashSet<Permission>`
- `AuthorizingRealm.hasRole()` — delegates to `SimpleAuthorizationInfo.getRoles()` which returns `Set<String>`
- `WildcardPermission` — parts stored as `List<Set<String>>`, membership checks use Set.contains/containsAll
- `DefaultEventBus.Subscription.onEvent()` — uses `HashSet<Object>` for dedup
- `DefaultFilterChainManager` — uses `Map.keySet()` (Set) for chain name lookups

The codebase is small and well-structured. All collection membership tests on
hot paths use Set-based data structures.

## Verdict

CLEAN — no CWE-407 defects found. Shiro's authorization and permission resolution
code properly uses Set data structures for membership testing.