russell@unturf.com
068ebbd29f
Scanned bitcoin/dragonfly/tor/transmission/nmap/ceph/allegro5 for additional CWE-407 defects. All repos found CLEAN beyond previously recorded patches. Updated tor/CLEAN.md to correctly reference existing tor-0001 through tor-0003.
30 lines
1.2 KiB
Markdown
30 lines
1.2 KiB
Markdown
# CLEAN — Hibernate ORM
|
|
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
|
|
|
|
## Scope
|
|
hibernate-core/src/main/java — SqmUtil, ActionQueue, BulkOperationCleanupAction,
|
|
LoadQueryInfluencers, StatefulPersistenceContext, ToOneAttributeMapping,
|
|
ManyToManyCollectionPart, BaseSqmToSqlAstConverter, GeneratedValuesProcessor.
|
|
|
|
## Findings
|
|
|
|
### ActionQueue — tableSpaces.contains()
|
|
Parameter `Set<? extends Serializable> tableSpaces` — O(1). Clean.
|
|
|
|
### BulkOperationCleanupAction — affectedTableSpaces.contains()
|
|
Parameter is `Set<?>` — O(1). Clean.
|
|
|
|
### LoadQueryInfluencers — enabledFetchProfileNames.contains()
|
|
`enabledFetchProfileNames` is `HashSet<String>` — O(1). Clean.
|
|
|
|
### ToOneAttributeMapping — targetKeyPropertyNames.contains()
|
|
`targetKeyPropertyNames` is `Set<String>` backed by `HashSet` — O(1). Clean.
|
|
|
|
### StatefulPersistenceContext — nullAssociations.contains(), insertedEntityIds.contains()
|
|
Both backed by `HashSet` implementations — O(1). Clean.
|
|
|
|
### BaseSqmToSqlAstConverter — visitedAssociationKeys.contains(), excludedEntityNames.contains()
|
|
Both are `Set` or `HashSet` fields — O(1). Clean.
|
|
|
|
## Result
|
|
**CLEAN. No actionable CWE-407 defects found in Hibernate ORM.**
|