java-topology/defects/nim/patch/CLEAN.md

Nim — CWE-407 Diamond Recursion Scan: CLEAN

Scan Date

2026-03-29

Targets Checked

1. Object type inheritance (isObjectSubtype, sigmatch.nim)

• File: compiler/sigmatch.nim, lines 619–636
• Mechanism: Single-inheritance while t != nil: t = t.baseClass chain. Nim objects have exactly one parent — no diamond possible.
• Result: CLEAN (single-parent chain, O(D) linear).

2. Concept matching (concepts.nim)

• File: compiler/concepts.nim
• Guard: MatchCon carries marker: initHashSet[ConceptTypePair]() — used to prevent infinite recursion in mutual-concept matching.
• conceptsMatch: Compares concept bodies structurally; processConcept uses the HashSet marker for cycle detection.
• Result: CLEAN — HashSet visited guard present.

3. Module dependency tracking (deps.nim)

• File: compiler/deps.nim, lines 282–286
• Guard: seenFiles = initHashSet[string]() with containsOrIncl.
• Result: CLEAN.

4. Type traversal in types.nim

• File: compiler/types.nim, line 1352
• Uses seen = initIntSet() with containsOrIncl(seen, result.id) for type alias chain traversal.
• Result: CLEAN.

5. AST cycle detection (trees.nim)

• File: compiler/trees.nim, cyclicTreeAux
• Uses visited: seq[PNode] (a stack, not a set) with linear for v in visited: if v == n check — O(V) per node, O(V²) total.
• However: This is DFS stack semantics (push on enter, pop on exit), correct for cycle detection in trees. cyclicTree is only called from vm.nim after macro expansion to validate the output — not in a hot compilation path.
• N is bounded by macro output AST size, not by type hierarchy depth. Not a diamond recursion issue.
• Result: Not CWE-407 (bounded, correct algorithm for stack-based DFS).

Conclusion

No CWE-407 diamond recursion defects found in Nim. Object inheritance is single-parent; concept matching uses a HashSet guard; module dependency tracking uses a HashSet.