36 lines
1.4 KiB
Markdown
36 lines
1.4 KiB
Markdown
# Apache Shiro — CWE-407 Scan Result: CLEAN
|
|
|
|
**Target:** Apache Shiro (Java security framework)
|
|
**Source:** https://github.com/apache/shiro (depth=1)
|
|
**Date:** 2026-03-30
|
|
**Scanner:** manual CWE-407 pattern scan
|
|
|
|
## Scan Scope
|
|
|
|
- `core/src/main/java/` — AuthorizingRealm, permission resolution, role checking
|
|
- `web/src/main/java/` — filter chain management, session management
|
|
- `event/src/main/java/` — event bus
|
|
- `config/` — OGDL configuration
|
|
- `lang/` — utility classes
|
|
|
|
## Keywords Searched
|
|
|
|
`.contains(` on List/ArrayList/Collection, `.indexOf(`, nested loops,
|
|
dedup patterns, `visited`/`seen` patterns.
|
|
|
|
## Findings
|
|
|
|
Apache Shiro uses appropriate data structures throughout:
|
|
- `AuthorizingRealm.getPermissions()` — collects into `HashSet<Permission>`
|
|
- `AuthorizingRealm.hasRole()` — delegates to `SimpleAuthorizationInfo.getRoles()` which returns `Set<String>`
|
|
- `WildcardPermission` — parts stored as `List<Set<String>>`, membership checks use Set.contains/containsAll
|
|
- `DefaultEventBus.Subscription.onEvent()` — uses `HashSet<Object>` for dedup
|
|
- `DefaultFilterChainManager` — uses `Map.keySet()` (Set) for chain name lookups
|
|
|
|
The codebase is small and well-structured. All collection membership tests on
|
|
hot paths use Set-based data structures.
|
|
|
|
## Verdict
|
|
|
|
CLEAN — no CWE-407 defects found. Shiro's authorization and permission resolution
|
|
code properly uses Set data structures for membership testing.
|