# CLEAN — Apache Thrift
Scanned 2026-03-29 for CWE-407.

## Scope

- `lib/java/src/main/java` — Java runtime library (PartialThriftComparer, TBase implementations)
- `compiler/cpp/src/thrift/parse/` — C++ IDL compiler (t_scope.h, t_program.h, t_const_value.h)

## Findings

| Location | Pattern | Type | Result |
|----------|---------|------|--------|
| `PartialThriftComparer.areEqual` (Set path) | `s2.contains(e1)` in loop over s1 | `s2` is `Set<Object>` (Java Set semantics per Thrift spec) | CLEAN |
| `t_scope.h` | `types_.find`, `services_.find`, `constants_.find` | `std::map` — O(log N) | CLEAN |
| `t_program.h` | namespace lookups | `std::map` | CLEAN |
| `contrib/thrift-maven-plugin` | `thriftPathElements.contains` | Called once per directory during classpath building, not in hot loop | LOW |

The Java library is minimal and the C++ compiler uses `std::map` (ordered map, O(log N) find). No quadratic list-membership pattern exists in the production hot path.

**Result: No actionable CWE-407 defects.**