java-topology/defects/pydantic/CLEAN.md

pydantic: CLEAN

CWE-407 scan: 2026-03-30

Source: https://github.com/pydantic/pydantic (depth=1, v2.13.0b3)

Scan scope

• pydantic/ and pydantic/_internal/ — Python source
• Focus: field validator dedup, model field membership, schema generation visited set, discriminator scanning
• Keywords: in list, .index(, nested for loops

Findings

No CWE-407 defects found.

• _internal/_decorators.py:489-497 — duplicate field serializer check uses seen: set[str] — correct O(1)
• _internal/_generate_schema.py:2877-2885 — circular reference detection uses visited: set[str] — correct O(1)
• _internal/_generate_schema.py:231 — converts fields to set() before membership test — correct O(1)
• _internal/_utils.py:151-170 — unique_list() has O(N^2) pattern with list .index() + not in, but this function is dead code in v2 (only called from v1/main.py compat layer, not imported by v2)
• Discriminated union handling uses dict-based lookups throughout
• Schema generation uses proper set-based visited tracking

Verdict

CLEAN — pydantic v2 uses sets/dicts appropriately for all membership tests in hot paths. The only O(N^2) function (unique_list) is dead code in v2.