# Nextcloud Server — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30
Target: https://github.com/nextcloud/server (PHP)
Focus: lib/private/, apps/ — sharing, file operations, CalDAV, contacts, app management, encryption, LDAP

## Summary

No CWE-407 defects found. Nextcloud uses PHP associative arrays (hash maps) for most
hot-path membership tests. The `in_array()` calls found (386 total, 62 inside foreach
loops) all operate on:

- Constant-size field/property arrays (< 15 elements)
- Config-level lists bounded by application count (< 100)
- Early-exit search patterns with small search spaces
- Error/logging paths not on hot execution path

## Notable non-defects reviewed

- `lib/private/AppConfig.php` strictnessApplied dedup — logging path only
- `lib/private/Collaboration/Collaborators/GroupPlugin.php` — bounded by $limit parameter
- `lib/private/Log/ExceptionSerializer.php` removeValuesFromArgs — error path only
- `apps/files_external/lib/Lib/ApplicableHelper.php` diffApplicable — config-level groups/users
- `lib/private/Files/Cache/Cache.php` normalizeData — constant-size field arrays