1.7 KiB
1.7 KiB
UNDF: UNDF-2026-000000366
Clojure Compiler — CWE-407 Scan Result: CLEAN
Files Scanned
src/jvm/clojure/lang/Compiler.java(9679 lines)src/jvm/clojure/lang/RT.java(2414 lines)src/jvm/clojure/lang/Namespace.java(277 lines)src/jvm/clojure/lang/Reflector.java(709 lines)
Verdict
CLEAN — No CWE-407 defects found.
Evidence
Clojure's compiler is architecturally immune to this class of defect because
it consistently uses persistent hash data structures from clojure.lang
for all membership and deduplication operations:
| Variable | Type | Membership | Complexity |
|---|---|---|---|
usedConstants |
IPersistentSet (PersistentHashSet) |
.contains(i) |
O(1) |
letFnLocals |
IPersistentSet |
.contains(lb) |
O(1) |
localsUsedInCatchFinally |
PersistentHashSet |
.contains(i) |
O(1) |
constantKeys (MapExpr) |
PersistentHashSet |
.contains(kval) |
O(1) |
AFN_FIS (FISupport) |
IPersistentSet |
.contains(target) |
O(1) |
OBJECT_METHODS (FISupport) |
IPersistentSet |
.contains(method.getName()) |
O(1) |
Namespace mappings |
IPersistentMap |
.containsKey(sym) |
O(1) |
Namespace aliases |
IPersistentMap |
.containsKey(alias) |
O(1) |
The ArrayList instances that appear (params, rets, methods in
MethodExpr and StaticMethodExpr) are used only for index-based access,
not for membership queries in hot paths.
Reflector.getMethods returns a list that is then passed to matchMethod,
which iterates once in O(M) — this is single-pass, not nested.
RT.java uses IPersistentMap/IPersistentSet for all namespace and type
lookups — all O(1).
Date
2026-03-27