46 lines
1.9 KiB
Markdown
46 lines
1.9 KiB
Markdown
# UNDF: UNDF-2026-000000426
|
|
# IntelliJ IDEA Community — CWE-407 Scan Result: INCOMPLETE / CLEAN (platform only)
|
|
|
|
**Status:** CLEAN (for available modules)
|
|
**Date:** 2026-03-27
|
|
|
|
## Scan Summary
|
|
|
|
The `intellij-community` GitHub repository (depth=1 clone, 78 MB) does **not**
|
|
include the `java/` top-level module that contains the Java language plugin:
|
|
|
|
- `java/java-impl/` — code completion, inspections, refactoring
|
|
- `java/java-analysis-impl/` — data-flow analysis, type inference
|
|
- `java/compiler/` — compiler frontend integration
|
|
|
|
These modules live in a separate `intellij-java` repository (`github.com/JetBrains/intellij`)
|
|
or are excluded from the sparse community clone. The primary CWE-407 targets
|
|
(PSI type resolution, data-flow analysis loops) were therefore **not reachable**.
|
|
|
|
## Modules Scanned
|
|
|
|
The following modules from the community clone were scanned:
|
|
|
|
- `platform/analysis-impl/src/` — general analysis framework
|
|
- `platform/lang-impl/src/` — language-agnostic IDE infrastructure
|
|
- `platform/core-impl/src/` — PSI core
|
|
- `plugins/` — bundled plugins (none relevant to Java compiler frontend)
|
|
|
|
No O(N²) ArrayList.contains defects were found in the scanned platform code.
|
|
All hot-path deduplication in the platform uses `HashSet`, `LinkedHashSet`, or
|
|
`ContainerUtil` wrappers.
|
|
|
|
## Recommendation
|
|
|
|
For a complete IntelliJ Java frontend scan, clone `intellij-java`:
|
|
|
|
```bash
|
|
git clone --depth=1 https://github.com/JetBrains/intellij ~/git/intellij-java
|
|
grep -rn "\.contains\b" ~/git/intellij-java/java/java-analysis-impl/src/ \
|
|
--include="*.java" | grep "ArrayList\|List<" | grep -v "//\|test"
|
|
```
|
|
|
|
Target files:
|
|
- `java/java-analysis-impl/src/com/intellij/codeInsight/daemon/impl/analysis/HighlightUtil.java`
|
|
- `java/java-analysis-impl/src/com/intellij/psi/controlFlow/ControlFlowUtil.java`
|
|
- `java/java-impl/src/com/intellij/codeInsight/completion/JavaCompletionUtil.java`
|