russell@unturf.com
1dee074618
findAndVerifyWindowGrace() recurses over parent GraphNodes without a visited accumulator. Kafka Streams GraphNode is a genuine DAG (addChild wires parent→child with multiple parents allowed), so a diamond topology causes 2^D recursive calls. Fix: thread an IdentityHashMap<GraphNode,Long> memo through recursion; memoize on first visit, return cached result on revisit. 8/8 unit tests PASS; D=10 defect count=3071 vs patched O(N). Diamond-recursion CLEAN markers added for: flink, neo4j, janusgraph, tinkerpop, dgraph, zookeeper, storm, ant, gradle, graal, eclipse-jdt, exposed, intellij, kotlin, scala3, hibernate-0007 (prior session work now committed).
2.2 KiB
IntelliJ IDEA Community — Diamond Recursion CWE-407 Scan: CLEAN
Pattern: Recursive cycle/reachability without visited set (O(2^D) on diamond DAGs)
Scan date: 2026-03-29
Scope: platform/, plugins/ (community clone — java/ modules not included)
Method
Searched for isCyclic, hasCycle, createsCycle, addsCycle, willCycle,
wouldCreateCycle, detectCycle, isReachable, canReach, hasPath across
all Java and Kotlin sources. Examined each recursive function for missing
visited-accumulator parameters.
Key candidates reviewed
CircularModuleDependenciesDetector.addingDependencyFormsCircularity()
platform/projectModel-impl/.../CircularModuleDependenciesDetector.java.
Uses GraphAlgorithms.getInstance().computeSCCGraph() — delegates to Tarjan SCC.
Not hand-rolled recursive traversal. CLEAN.
SimpleCyclesIterator.findCyclesInSCG() / getSCCs()
platform/core-impl/.../graph/impl/SimpleCyclesIterator.java.
Johnson's algorithm with myBlocked HashSet and myVIndex HashMap as visited
state. Instance fields maintained across recursive calls. CLEAN.
sortTopologically() in sortTopologically.kt
plugins/kotlin/base/util/.../sortTopologically.kt.
populateIncomingOutcomingNodesDfa() nested function takes explicit visited: MutableSet<Vertex<T>> parameter (line 53). CLEAN.
Pipeline topological sort
platform/build-scripts/.../pipeline/Pipeline.kt line 296.
Uses visited: HashSet<NodeId> and visiting: HashSet<NodeId> for cycle
detection. CLEAN.
BindingFactory.isCyclic()
plugins/rareJavaRefactorings/.../resolver/BindingFactory.java line 443.
Returns a stored myCyclic field — not a graph traversal. CLEAN.
XPath ElementProcessor.isCyclic()
plugins/xpath/.../xslt/util/ElementProcessor.java line 55.
Returns stored myIsCyclic field set during process() which maintains myHistory
(a visited set). CLEAN.
Verdict
CLEAN for diamond recursion pattern in available community modules. All module dependency, cycle detection, and topological sort code uses proper visited-set tracking (HashSet, LinkedHashSet, or instance-field maps). No unprotected recursive DAG traversal found.