java-topology/defects/shiro/patch/CLEAN.md

Apache Shiro — CWE-407 Scan Result: CLEAN

Target: Apache Shiro (Java security framework) Source: https://github.com/apache/shiro (depth=1) Date: 2026-03-30 Scanner: manual CWE-407 pattern scan

Scan Scope

• core/src/main/java/ — AuthorizingRealm, permission resolution, role checking
• web/src/main/java/ — filter chain management, session management
• event/src/main/java/ — event bus
• config/ — OGDL configuration
• lang/ — utility classes

Keywords Searched

.contains( on List/ArrayList/Collection, .indexOf(, nested loops, dedup patterns, visited/seen patterns.

Findings

Apache Shiro uses appropriate data structures throughout:

• AuthorizingRealm.getPermissions() — collects into HashSet<Permission>
• AuthorizingRealm.hasRole() — delegates to SimpleAuthorizationInfo.getRoles() which returns Set<String>
• WildcardPermission — parts stored as List<Set<String>>, membership checks use Set.contains/containsAll
• DefaultEventBus.Subscription.onEvent() — uses HashSet<Object> for dedup
• DefaultFilterChainManager — uses Map.keySet() (Set) for chain name lookups

The codebase is small and well-structured. All collection membership tests on hot paths use Set-based data structures.

Verdict

CLEAN — no CWE-407 defects found. Shiro's authorization and permission resolution code properly uses Set data structures for membership testing.