# UNDF: UNDF-2026-000000295
# Spring Framework — Deeper CWE-407 Scan CLEAN Report

## Scan Date
2026-03-27

## Areas Scanned (beyond spring-0001 through spring-0006)

| Area | Files Scanned | Finding |
|------|---------------|---------|
| `spring-aop` AdvisedSupport.addInterface() | ArrayList.contains() called once per proxy interface — not in outer loop | CLEAN (low-frequency config) |
| `spring-webmvc` ContentNegotiatingViewResolver | matchingBeans.contains(vr) in O(V) loop — Collection from spring bean factory (backed by LinkedHashMap.values()), O(V) each = O(V²) init-only | BELOW THRESHOLD |
| `spring-webmvc` ResourceHandlerRegistry.hasMappingForPattern() | Arrays.asList(array).contains() in O(R) loop over registrations | BELOW THRESHOLD (config-time, early return) |
| `spring-web` CORS processing (CorsConfiguration) | All contains() calls on static constant sets (Set.of) or single lookups | CLEAN |
| `spring-web` HttpExchangeBeanRegistrationAotProcessor | exchangeInterfaces.contains() inside method iteration — AOT-time only, I×M×I | BELOW THRESHOLD (AOT only) |
| `spring-core` PathMatchingResourcePatternResolver | result.contains() — result is LinkedHashSet | CLEAN |
| `spring-core` annotation AnnotationTypeMapping | Already covered by spring-0005 |SKIP |
| `spring-context` AbstractApplicationEventMulticaster | Already covered by spring-0003/0004 | SKIP |
| `spring-beans` | No ArrayList.contains() in loops found | CLEAN |

## Confirmed New Defects This Session
- **spring-0006**: `VersionResourceResolver.addFixedVersionStrategy()` O(N²) — patched

## Summary
Spring framework scan is comprehensive through spring-0006. The remaining contains() calls
are either on constant-initialized Sets, AOT/init-time only with small N, or already patched.
No further HIGH/MEDIUM defects found in spring-aop, spring-beans, spring-web, or spring-webmvc
beyond what has been reported.