java-topology/defects/commons-lang/patch/CLEAN.md

CLEAN — Apache Commons Lang

Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

Findings

• ClassUtils.getAllInterfaces() — CLEAN: uses LinkedHashSet with if (interfacesFound.add(i)) guard; O(N+E) correct
• ClassUtils.getAllSuperclasses() — CLEAN: simple linear superclass chain, no diamond issue
• TypeUtils.getClosestParentType() / mutual recursion with isAssignable() — CLEAN: each recursive call reduces cls to ONE closest parent type; linear O(depth) not O(2^D)
• TypeUtils.determineTypeArguments() typeVarList.contains() — N is bounded by generic arity (typically 1–3); negligible
• InheritanceUtils.distance() — CLEAN: simple linear recursion
• AnnotationUtils — CLEAN: no hierarchy traversal

Result: No actionable CWE-407 defects.