# Apache Struts — CWE-407 Scan Result: CLEAN

## Scan Date: 2026-03-29

## Method Scanned
Searched `core/` for recursive traversal of interceptor/action dependency graphs without
visited sets.

## Findings

### ActionChainResult — action chain cycle detection
`ActionChainResult` uses a `LinkedList<String>` chain history stored in `ActionContext` as
the cycle guard. The chain is appended on each hop; an `IllegalArgumentException` is thrown
if the action name is already in the chain (infinite recursion guard). This is O(N) list
membership per hop for N chain steps — acceptable for short action chains (typically 1-3
deep in practice, bounded by configuration). Not a hot path in production traffic.

### InterceptorBuilder.constructParameterizedInterceptorReferences
The recursive call here resolves nested interceptor-stack parameter names. Recursion is
driven by dotted-param keys (`stack1.interceptor1.param`) that are consumed at each level —
no shared DAG is traversed. Termination is guaranteed by the param key prefix being stripped
on each level. No visited guard needed; not CWE-407.

### InterceptorStackConfig.getInterceptors
Returns a pre-built flat `List<InterceptorMapping>` — no recursive graph traversal at runtime.

## Conclusion
CLEAN. No CWE-407 defects found in Apache Struts.