43 lines
1.6 KiB
Markdown
43 lines
1.6 KiB
Markdown
# Clojure Compiler — CWE-407 Scan Result: CLEAN
|
|
|
|
## Files Scanned
|
|
|
|
- `src/jvm/clojure/lang/Compiler.java` (9679 lines)
|
|
- `src/jvm/clojure/lang/RT.java` (2414 lines)
|
|
- `src/jvm/clojure/lang/Namespace.java` (277 lines)
|
|
- `src/jvm/clojure/lang/Reflector.java` (709 lines)
|
|
|
|
## Verdict
|
|
|
|
**CLEAN** — No CWE-407 defects found.
|
|
|
|
## Evidence
|
|
|
|
Clojure's compiler is architecturally immune to this class of defect because
|
|
it consistently uses **persistent hash data structures** from `clojure.lang`
|
|
for all membership and deduplication operations:
|
|
|
|
| Variable | Type | Membership | Complexity |
|
|
|---|---|---|---|
|
|
| `usedConstants` | `IPersistentSet` (PersistentHashSet) | `.contains(i)` | O(1) |
|
|
| `letFnLocals` | `IPersistentSet` | `.contains(lb)` | O(1) |
|
|
| `localsUsedInCatchFinally` | `PersistentHashSet` | `.contains(i)` | O(1) |
|
|
| `constantKeys` (MapExpr) | `PersistentHashSet` | `.contains(kval)` | O(1) |
|
|
| `AFN_FIS` (FISupport) | `IPersistentSet` | `.contains(target)` | O(1) |
|
|
| `OBJECT_METHODS` (FISupport) | `IPersistentSet` | `.contains(method.getName())` | O(1) |
|
|
| Namespace `mappings` | `IPersistentMap` | `.containsKey(sym)` | O(1) |
|
|
| Namespace `aliases` | `IPersistentMap` | `.containsKey(alias)` | O(1) |
|
|
|
|
The `ArrayList` instances that appear (`params`, `rets`, `methods` in
|
|
`MethodExpr` and `StaticMethodExpr`) are used only for index-based access,
|
|
not for membership queries in hot paths.
|
|
|
|
`Reflector.getMethods` returns a list that is then passed to `matchMethod`,
|
|
which iterates once in O(M) — this is single-pass, not nested.
|
|
|
|
`RT.java` uses `IPersistentMap`/`IPersistentSet` for all namespace and type
|
|
lookups — all O(1).
|
|
|
|
## Date
|
|
|
|
2026-03-27
|