# Clojure Compiler — CWE-407 Scan Result: CLEAN

## Files Scanned

- `src/jvm/clojure/lang/Compiler.java` (9679 lines)
- `src/jvm/clojure/lang/RT.java` (2414 lines)
- `src/jvm/clojure/lang/Namespace.java` (277 lines)
- `src/jvm/clojure/lang/Reflector.java` (709 lines)

## Verdict

**CLEAN** — No CWE-407 defects found.

## Evidence

Clojure's compiler is architecturally immune to this class of defect because
it consistently uses **persistent hash data structures** from `clojure.lang`
for all membership and deduplication operations:

| Variable | Type | Membership | Complexity |
|---|---|---|---|
| `usedConstants` | `IPersistentSet` (PersistentHashSet) | `.contains(i)` | O(1) |
| `letFnLocals` | `IPersistentSet` | `.contains(lb)` | O(1) |
| `localsUsedInCatchFinally` | `PersistentHashSet` | `.contains(i)` | O(1) |
| `constantKeys` (MapExpr) | `PersistentHashSet` | `.contains(kval)` | O(1) |
| `AFN_FIS` (FISupport) | `IPersistentSet` | `.contains(target)` | O(1) |
| `OBJECT_METHODS` (FISupport) | `IPersistentSet` | `.contains(method.getName())` | O(1) |
| Namespace `mappings` | `IPersistentMap` | `.containsKey(sym)` | O(1) |
| Namespace `aliases` | `IPersistentMap` | `.containsKey(alias)` | O(1) |

The `ArrayList` instances that appear (`params`, `rets`, `methods` in
`MethodExpr` and `StaticMethodExpr`) are used only for index-based access,
not for membership queries in hot paths.

`Reflector.getMethods` returns a list that is then passed to `matchMethod`,
which iterates once in O(M) — this is single-pass, not nested.

`RT.java` uses `IPersistentMap`/`IPersistentSet` for all namespace and type
lookups — all O(1).

## Date

2026-03-27