38 lines
1.7 KiB
Markdown
38 lines
1.7 KiB
Markdown
# Keycloak — CWE-407 Scan Result: CLEAN
|
|
|
|
**Target:** Keycloak (Java identity/access management)
|
|
**Source:** https://github.com/keycloak/keycloak (depth=1)
|
|
**Date:** 2026-03-30
|
|
**Scanner:** manual CWE-407 pattern scan
|
|
|
|
## Scan Scope
|
|
|
|
- `services/src/main/java/` — core services, client registration, OIDC protocol, authorization
|
|
- `server-spi/src/main/java/` — SPI interfaces and utilities (RoleUtils, etc.)
|
|
- `server-spi-private/src/main/java/` — authorization policy evaluation, permission resolution
|
|
- `model/` — JPA, Infinispan cache adapters, storage layer
|
|
- `common/` — utility classes
|
|
|
|
## Keywords Searched
|
|
|
|
`.contains(` on List/ArrayList, `.indexOf(`, nested loops, dedup patterns via
|
|
List membership, `visited`/`seen` patterns using ArrayList/LinkedList.
|
|
|
|
## Findings
|
|
|
|
Keycloak consistently uses `HashSet` for membership testing throughout:
|
|
- `RoleUtils.expandCompositeRoles()` — uses `Set<RoleModel> visited`
|
|
- Infinispan cached entities (`CachedUser`, `CachedClient`, `CachedClientScope`) — all use `Set<String>` for role mappings, scopes, groups
|
|
- `DefaultClientSessionContext` — uses `Set<ClientScopeModel>`, `Set<RoleModel>`, `Set<String>`
|
|
- `DefaultCors` — uses `Set<String>` for allowed origins
|
|
- `WebOriginsUtils` — uses `HashSet<String>`
|
|
- Authorization policy evaluation (`DecisionPermissionCollector`) — uses `HashSet`/`LinkedHashSet`
|
|
|
|
Minor List.contains usage found in `ProtocolMappersClientRegistrationPolicy` and
|
|
`ClientScopesClientRegistrationPolicy` (admin client registration path), but these
|
|
operate on small config lists (<20 items) and are not hot-path. Not reportable.
|
|
|
|
## Verdict
|
|
|
|
CLEAN — no CWE-407 defects found. Keycloak's codebase is well-disciplined about
|
|
using Set data structures for membership testing.
|