java-topology/defects/keycloak/patch/CLEAN.md

Keycloak — CWE-407 Scan Result: CLEAN

Target: Keycloak (Java identity/access management) Source: https://github.com/keycloak/keycloak (depth=1) Date: 2026-03-30 Scanner: manual CWE-407 pattern scan

Scan Scope

• services/src/main/java/ — core services, client registration, OIDC protocol, authorization
• server-spi/src/main/java/ — SPI interfaces and utilities (RoleUtils, etc.)
• server-spi-private/src/main/java/ — authorization policy evaluation, permission resolution
• model/ — JPA, Infinispan cache adapters, storage layer
• common/ — utility classes

Keywords Searched

.contains( on List/ArrayList, .indexOf(, nested loops, dedup patterns via List membership, visited/seen patterns using ArrayList/LinkedList.

Findings

Keycloak consistently uses HashSet for membership testing throughout:

• RoleUtils.expandCompositeRoles() — uses Set<RoleModel> visited
• Infinispan cached entities (CachedUser, CachedClient, CachedClientScope) — all use Set<String> for role mappings, scopes, groups
• DefaultClientSessionContext — uses Set<ClientScopeModel>, Set<RoleModel>, Set<String>
• DefaultCors — uses Set<String> for allowed origins
• WebOriginsUtils — uses HashSet<String>
• Authorization policy evaluation (DecisionPermissionCollector) — uses HashSet/LinkedHashSet

Minor List.contains usage found in ProtocolMappersClientRegistrationPolicy and ClientScopesClientRegistrationPolicy (admin client registration path), but these operate on small config lists (<20 items) and are not hot-path. Not reportable.

Verdict

CLEAN — no CWE-407 defects found. Keycloak's codebase is well-disciplined about using Set data structures for membership testing.