# Ruby — CWE-407 Diamond Traversal Scan: CLEAN

Scanned: 2026-03-30

## Files examined

- `lib/rubygems/specification.rb` — `traverse` method uses a Hash (`visited = {}`) with `visited.key?` guard; O(N) not O(2^D)
- `lib/bundler/vendor/thor/lib/thor/runner.rb` — `klasses.select { |k| k.ancestors.include?(Thor::Group) }` uses Ruby's built-in linearized MRO

## Result

No diamond recursion defects found. Ruby's `ancestors` method returns the C3-linearized MRO
(no duplicates). `Gem::Specification#traverse` uses a Hash-based visited guard preventing
re-traversal. No manually-recursive `__bases__`-equivalent traversal found in stdlib.