java-topology/defects/hibernate/patch/hibernate-deeper-CLEAN.md

UNDF: UNDF-2026-000000107

Hibernate ORM — Deeper CWE-407 Scan CLEAN Report

Scan Date

2026-03-27

Areas Scanned (beyond hibernate-0001 through hibernate-0006)

Area	Files Scanned	Finding
hibernate-core NaturalIdResolutionsImpl	invalidNaturalIdList.contains() — single lookup per entity, not in outer loop	CLEAN
hibernate-core SemanticQueryBuilder	enumTypes.contains(), JPA_STANDARD_FUNCTIONS.contains() — both are Set<>	CLEAN
hibernate-core BaseSqmToSqlAstConverter	entityNameUsesSet, visitedAssociationKeys — all Set<> types	CLEAN
hibernate-core SqmCteStatement	cteTable.getAttributes().contains() — validation-only, exception path, tiny N	BELOW THRESHOLD
hibernate-core InFlightMetadataCollectorImpl (defaultNamed*)	All HashSet — O(1) contains	CLEAN
hibernate-core InFlightMetadataCollectorImpl (orderedFkSecondPasses)	Already covered by hibernate-0004	SKIP
hibernate-core AnnotationMetadataSourceProcessorImpl (orderHierarchy)	Already covered by hibernate-0005	SKIP
hibernate-core sql/Template	All contains() on static final Set fields	CLEAN
hibernate-core sql/ast	All contains() on Set<> typed fields	CLEAN
hibernate-core query/hql/SemanticQueryBuilder	Set<> for all hot lookups	CLEAN
hibernate-core mapping/PersistentClass.containsColumn()	getSelectables().contains() in O(D) declaredProperties loop, called from isDefinedOnMultipleSubclasses() — O(D×S) but subclass-specific, not N² on entity count	BELOW THRESHOLD
hibernate-core mapping/Constraint, ForeignKey, Index	Already covered by hibernate-0001/0002/0003	SKIP

Confirmed New Defects This Session

• hibernate-0006: AbstractEntityPersister subclass alias closure O(T²) — patched

Summary

Hibernate ORM scan is comprehensive through hibernate-0006. The remaining contains() calls are on properly-typed Set/HashSet/LinkedHashSet fields or are in low-frequency validation paths with trivially small N. No further HIGH/MEDIUM defects found beyond what has been reported.