java-topology/defects/intellij/patch/intellij-CLEAN.md

UNDF: UNDF-2026-000000426

IntelliJ IDEA Community — CWE-407 Scan Result: INCOMPLETE / CLEAN (platform only)

Status: CLEAN (for available modules) Date: 2026-03-27

Scan Summary

The intellij-community GitHub repository (depth=1 clone, 78 MB) does not include the java/ top-level module that contains the Java language plugin:

• java/java-impl/ — code completion, inspections, refactoring
• java/java-analysis-impl/ — data-flow analysis, type inference
• java/compiler/ — compiler frontend integration

These modules live in a separate intellij-java repository (github.com/JetBrains/intellij) or are excluded from the sparse community clone. The primary CWE-407 targets (PSI type resolution, data-flow analysis loops) were therefore not reachable.

Modules Scanned

The following modules from the community clone were scanned:

• platform/analysis-impl/src/ — general analysis framework
• platform/lang-impl/src/ — language-agnostic IDE infrastructure
• platform/core-impl/src/ — PSI core
• plugins/ — bundled plugins (none relevant to Java compiler frontend)

No O(N²) ArrayList.contains defects were found in the scanned platform code. All hot-path deduplication in the platform uses HashSet, LinkedHashSet, or ContainerUtil wrappers.

Recommendation

For a complete IntelliJ Java frontend scan, clone intellij-java:

git clone --depth=1 https://github.com/JetBrains/intellij ~/git/intellij-java
grep -rn "\.contains\b" ~/git/intellij-java/java/java-analysis-impl/src/ \
     --include="*.java" | grep "ArrayList\|List<" | grep -v "//\|test"

Target files:

• java/java-analysis-impl/src/com/intellij/codeInsight/daemon/impl/analysis/HighlightUtil.java
• java/java-analysis-impl/src/com/intellij/psi/controlFlow/ControlFlowUtil.java
• java/java-impl/src/com/intellij/codeInsight/completion/JavaCompletionUtil.java