Repository Analysis

google/oss-fuzz

OSS-Fuzz - continuous fuzzing for open source software.

21.0 Moderate AI signal View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of google/oss-fuzz, a Shell project with 12,426 GitHub stars. SynthScan v2.0 examined 267,670 lines of code across 4828 source files, recording 4375 pattern matches distributed across 22 syntactic categories. The overall adjusted score of 21.0 places this repository in the Moderate AI signal band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

21.0
Adjusted Score
21.0
Raw Score
100%
Time Factor
2026-07-14
Last Push
12.4K
Stars
Shell
Language
267.7K
Lines of Code
4.8K
Files
4.4K
Pattern Hits
2026-07-14
Scan Date
0.02
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 12HIGH 68MEDIUM 438LOW 3857

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 4375 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Over-Commented Block3001 hits · 2990 pts
SeverityFileLineSnippetContext
LOWinfra/test_repos.py1# Copyright 2020 Google LLCCOMMENT
LOWinfra/repo_manager_test.py1# Copyright 2019 Google LLCCOMMENT
LOWinfra/pr_helper_test.py1#!/usr/bin/env pythonCOMMENT
LOWinfra/helper_test.py1# Copyright 2021 Google LLCCOMMENT
LOWinfra/utils_test.py1# Copyright 2020 Google LLCCOMMENT
LOWinfra/manifest.py1#! /usr/bin/env python3COMMENT
LOWinfra/constants.py1# Copyright 2021 Google LLCCOMMENT
LOWinfra/repo_manager.py1# Copyright 2019 Google LLCCOMMENT
LOWinfra/build_specified_commit.py1# Copyright 2019 Google LLCCOMMENT
LOWinfra/retry.py1# Copyright 2020 Google LLCCOMMENT
LOWinfra/templates.py1# Copyright 2016 Google Inc.COMMENT
LOWinfra/templates.py21primary_contact: "<primary_contact_email>"COMMENT
LOWinfra/templates.py61#COMMENT
LOWinfra/templates.py81COMMENT
LOWinfra/utils.py1# Copyright 2020 Google LLCCOMMENT
LOWinfra/presubmit.py1#!/usr/bin/env python3COMMENT
LOWinfra/helper.py1#!/usr/bin/env pythonCOMMENT
LOWinfra/pr_helper.py1#!/usr/bin/env pythonCOMMENT
LOWinfra/build_specified_commit_test.py1# Copyright 2019 Google LLCCOMMENT
LOWinfra/bisector.py1# Copyright 2019 Google LLCCOMMENT
LOWinfra/common_utils.py1# Copyright 2025 Google LLCCOMMENT
LOWinfra/bisector_test.py1# Copyright 2019 Google LLCCOMMENT
LOWinfra/chronos/integrity_validator_check_replay.py1# Copyright 2025 Google LLCCOMMENT
LOWinfra/chronos/container_patch_replay_test.sh1#!/bin/bash -euxCOMMENT
LOWinfra/chronos/container_coverage_collection.sh1#!/bin/bash -euxCOMMENT
LOWinfra/chronos/integrity_validator_run_tests.py1# Copyright 2025 Google LLCCOMMENT
LOWinfra/chronos/__init__.py1#!/bin/bash -euxCOMMENT
LOWinfra/chronos/container_cache_build.sh1#!/bin/bash -euxCOMMENT
LOWinfra/chronos/coverage_test_collection.py1#!/bin/bash -euxCOMMENT
LOWinfra/chronos/container_patch_tests_test.sh1#!/bin/bash -euxCOMMENT
LOWinfra/chronos/manager.py1# Copyright 2025 Google LLCCOMMENT
LOWinfra/experimental/chronos/match_artifacts.sh1#!/usr/bin/bash -euxCOMMENT
LOWinfra/experimental/chronos/build_on_cloudbuild.sh1#!/bin/bashCOMMENT
LOWinfra/experimental/chronos/build_all.sh1#!/bin/bashCOMMENT
LOWinfra/experimental/chronos/cloudbuild_all.yaml1# Copyright 2024 Google LLCCOMMENT
LOWinfra/experimental/chronos/cloudbuild.yaml1# Copyright 2024 Google LLCCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh1#!/bin/bash -euCOMMENT
LOWinfra/experimental/chronos/check_tests.sh1#!/bin/bashCOMMENT
LOWinfra/experimental/chronos/chronos.sh1# Copyright 2024 Google LLCCOMMENT
LOWinfra/experimental/chronos/e2e-replay-build.sh1#!/usr/bin/bashCOMMENT
LOWinfra/experimental/agent-skills/copy_to_global.sh1#!/bin/bash -euCOMMENT
LOWinfra/experimental/agent-skills/helper.py1#!/usr/bin/env python3COMMENT
LOWinfra/experimental/mcp/config.py1# Copyright 2025 Google LLCCOMMENT
LOWinfra/experimental/mcp/client.py1# Copyright 2025 Google LLCCOMMENT
LOWinfra/experimental/mcp/oss_fuzz_server.py1# Copyright 2025 Google LLCCOMMENT
LOWinfra/experimental/SystemSan/SystemSan.cpp21#include <stdio.h>COMMENT
LOW…oEs/pytorch-lightning-1.5.10/fuzz_pytorch_lightning.py1#!/usr/local/bin/python3COMMENT
LOW…ental/SystemSan/PoEs/pytorch-lightning-1.5.10/build.sh1#!/bin/bash -euCOMMENT
LOW…mental/SystemSan/PoEs/node-shell-quote-v1.7.3/build.sh1#!/bin/bash -euCOMMENT
LOWinfra/tools/hold_back_images.py1#!/usr/bin/env pythonCOMMENT
LOWinfra/tools/wycheproof/run.py1#!/usr/bin/env python3COMMENT
LOWinfra/tools/wycheproof/package.bash1#!/bin/bashCOMMENT
LOWinfra/tools/wycheproof/launcher.py1#!/usr/bin/env pythonCOMMENT
LOWinfra/tools/wycheproof/generate_job.py1#!/usr/bin/env python3COMMENT
LOWinfra/ci/build.py1#!/usr/bin/env pythonCOMMENT
LOWinfra/ci/build_test.py1# Copyright 2020 Google LLCCOMMENT
LOWinfra/ci/check_base_os.py1# Copyright 2025 Google LLCCOMMENT
LOWinfra/base-images/list_images.py1# Copyright 2025 Google LLCCOMMENT
LOWinfra/base-images/all.sh1#!/bin/bash -euxCOMMENT
LOWinfra/base-images/all.sh21# official list of images from the Python source of truth, ensuring it neverCOMMENT
2941 more matches not shown…
Self-Referential Comments248 hits · 741 pts
SeverityFileLineSnippetContext
MEDIUMinfra/experimental/mcp/oss_fuzz_server.py40# Create an MCP server with a nameCOMMENT
MEDIUMinfra/experimental/mcp/oss_fuzz_server.py138 max_length = 5000 # Define a maximum length for logsCODE
MEDIUMinfra/base-images/base-builder/make_build_replayable.py78 # Create a shell wrapper that stubs out `configure` and `autogen`.STRING
MEDIUM…/base-images/base-builder/install_deps_ubuntu-24-04.sh51# Create a custom apt configuration to allow downgrades and non-interactive installs.COMMENT
MEDIUM…cifuzz/filestore/github_actions/github_actions_test.py201 # Create a tarball.COMMENT
MEDIUMprojects/jansi/build.sh40 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/nimbus-jwt/build.sh67 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/cbor-java/build.sh32# Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/stax/build.sh69 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/spring-shell/build.sh52 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/apache-commons-cli/build.sh39 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/checker-framework/build.sh48 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/calcite/build.sh68 # Create an execution wrapper for every fuzztargetCOMMENT
MEDIUMprojects/opt_einsum/fuzz_parser.py25 # Create a numpy array with fuzzer-seeded entries.COMMENT
MEDIUMprojects/hamcrest/build.sh41 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/apache-commons-fileupload/build.sh66 # Create an execution wrapper for every fuzztargetCOMMENT
MEDIUMprojects/javassist/build.sh46 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/qdox/build.sh70 # Create an execution wrapper for every fuzztargetCOMMENT
MEDIUMprojects/apache-commons-codec/build.sh38 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/graphql-java/build.sh61 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/json-simple/build.sh64 # Create an execution wrapper for every fuzztargetCOMMENT
MEDIUMprojects/py-serde/fuzz_model.py28 # Create an arbitrary Model structureCOMMENT
MEDIUMprojects/jul-to-slf4j/build.sh38 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/jts/build.sh45 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/jackson-databind/build.sh65 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/snakeyaml/build.sh40 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/spring-cloud-stream/build.sh55 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/netty-tcnative/build.sh46 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/ohc/build.sh42 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/presto/build.sh74 # Create an execution wrapper for every fuzztargetCOMMENT
MEDIUMprojects/spring-data-jpa/build.sh42 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/jsch/build.sh67 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/feign/build.sh61 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/checkstyle/build.sh52 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/spring-cloud-commons/build.sh80 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/dom4j/build.sh38 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/g-auth-library-java/build.sh70 # Create an execution wrapper for every fuzztargetCOMMENT
MEDIUMprojects/httpcomponents-core/build.sh40 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/async-http-client/build.sh70 # Create an execution wrapper for every fuzztargetCOMMENT
MEDIUMprojects/pdfbox/build.sh69 # Create an execution wrapper for every fuzztargetCOMMENT
MEDIUMprojects/gson/build.sh40# Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/reflections/build.sh45 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/jooq/build.sh65 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/kie-soup/build.sh40 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/jsqlparser/build.sh69 # Create an execution wrapper for every fuzztargetCOMMENT
MEDIUMprojects/jackson-datatype-joda/build.sh45 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/apache-commons-collections/build.sh45 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/lucene/build.sh45 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/open-json/build.sh43 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/junrar/build.sh42 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/univocity-parsers/build.sh70 # Create an execution wrapper for every fuzztargetCOMMENT
MEDIUMprojects/spring-integration/build.sh48 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/mvel/build.sh66 # Create an execution wrapper for every fuzztargetCOMMENT
MEDIUMprojects/antlr3-java/build.sh39 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/xmlunit/build.sh46# Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/jersey/build.sh44 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/tomcat/build.sh54 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/apache-commons-math/build.sh40 # Create an execution wrapper that executes Jazzer with the correct arguments.COMMENT
MEDIUMprojects/apache-tika/build.sh53 # Create an execution wrapper for every fuzztargetCOMMENT
MEDIUMprojects/closure-compiler/build.sh65 # Create an execution wrapper for every fuzztargetCOMMENT
188 more matches not shown…
Decorative Section Separators142 hits · 332 pts
SeverityFileLineSnippetContext
MEDIUMprojects/freeradius/generate_seeds.py58# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py60# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py167# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py169# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py213# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py215# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py247# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py249# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py284# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py286# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py318# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py320# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py360# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py362# ==========================================================================COMMENT
MEDIUMprojects/freeradius/generate_seeds.py908# ==========================================================================COMMENT
MEDIUMprojects/libheif/generate_seeds.py49# --------------------------------------------------------------------------COMMENT
MEDIUMprojects/libheif/generate_seeds.py51# --------------------------------------------------------------------------COMMENT
MEDIUMprojects/libheif/generate_seeds.py152# --------------------------------------------------------------------------COMMENT
MEDIUMprojects/libheif/generate_seeds.py154# --------------------------------------------------------------------------COMMENT
MEDIUMprojects/libheif/generate_seeds.py214# --------------------------------------------------------------------------COMMENT
MEDIUMprojects/libheif/generate_seeds.py479# --------------------------------------------------------------------------COMMENT
MEDIUMprojects/ghostscript/generate_seeds.py49# --------------------------------------------------------------------------COMMENT
MEDIUMprojects/ghostscript/generate_seeds.py51# --------------------------------------------------------------------------COMMENT
MEDIUMprojects/ghostscript/generate_seeds.py712# --------------------------------------------------------------------------COMMENT
MEDIUMprojects/ghostscript/generate_seeds.py96# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py98# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py145# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py147# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py188# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py190# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py215# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py217# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py249# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py251# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py270# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py272# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py315# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py317# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py351# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py353# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py394# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py396# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py417# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py419# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py452# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py454# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py497# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py499# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py520# --------------------------------------------------------------------------STRING
MEDIUMprojects/ghostscript/generate_seeds.py524# --------------------------------------------------------------------------STRING
MEDIUMprojects/binutils/generate_seeds.py37# ──────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMprojects/binutils/generate_seeds.py39# ──────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMprojects/binutils/generate_seeds.py259 # ── symbol / relocation helpers ──────────────────────────────────────COMMENT
MEDIUMprojects/binutils/generate_seeds.py289# ──────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMprojects/binutils/generate_seeds.py291# ──────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMprojects/binutils/generate_seeds.py342# ──────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMprojects/binutils/generate_seeds.py344# ──────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMprojects/binutils/generate_seeds.py632# ──────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMprojects/binutils/generate_seeds.py634# ──────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMprojects/binutils/generate_seeds.py750# ──────────────────────────────────────────────────────────────────────────COMMENT
82 more matches not shown…
Unused Imports350 hits · 329 pts
SeverityFileLineSnippetContext
LOWinfra/helper.py20CODE
LOWinfra/helper.py28CODE
LOWinfra/experimental/contrib/arvo/arvo_reproducer.py41CODE
LOWinfra/ci/build.py19CODE
LOW…/base-builder/sanitizers/pysecsan/pysecsan/__init__.py17CODE
LOWinfra/cifuzz/fuzz_target_test.py26CODE
LOWinfra/cifuzz/filestore/gsutil/__init__.py18CODE
LOWinfra/cifuzz/filestore/gitlab/__init__.py17CODE
LOWinfra/cifuzz/filestore/gitlab/__init__.py20CODE
LOWinfra/cifuzz/filestore/gitlab/__init__.py23CODE
LOWinfra/cifuzz/filestore/filesystem/__init__.py15CODE
LOWinfra/cifuzz/filestore/filesystem/__init__.py17CODE
LOWinfra/cifuzz/filestore/filesystem/__init__.py18CODE
LOWprojects/psqlparse/fuzz_parse.py20CODE
LOWprojects/psqlparse/fuzz_parse.py26CODE
LOWprojects/flask/cors_fuzz_flask.py19CODE
LOWprojects/mdit-py-plugins/fuzz_containers.py20CODE
LOWprojects/mdit-py-plugins/fuzz_plugins_individually.py20CODE
LOWprojects/keras/fuzz_model.py17CODE
LOWprojects/keras/fuzz_model.py18CODE
LOWprojects/keras/fuzz_model.py19CODE
LOWprojects/keras/fuzz_serialization.py19CODE
LOWprojects/aiohttp/fuzz_http_parser.py32CODE
LOWprojects/aiohttp/fuzz_http_payload_parser.py31CODE
LOWprojects/aiohttp/fuzz_payload_url.py21CODE
LOWprojects/aiohttp/fuzz_web_request.py16CODE
LOWprojects/aiohttp/fuzz_web_request.py23CODE
LOWprojects/pyasn1/fuzz_decode.py16CODE
LOWprojects/pem/fuzz_pem.py16CODE
LOWprojects/py-serde/fuzz_model.py16CODE
LOWprojects/ffmpeg/group_seed_corpus.py18CODE
LOWprojects/pymysql/fuzz_connection.py24CODE
LOWprojects/toolz/fuzz_itertoolz.py18CODE
LOWprojects/toolz/fuzz_itertoolz.py18CODE
LOWprojects/toolz/fuzz_itertoolz.py18CODE
LOWprojects/gpowerd/translate_protos.py19CODE
LOWprojects/defusedxml/fuzz_etree_parse.py20CODE
LOWprojects/defusedxml/fuzz_parse_string.py22CODE
LOWprojects/attrs/fuzz_attrs.py22CODE
LOWprojects/pyrsistent/fuzz_vector.py16CODE
LOWprojects/oauthlib/fuzz_oauth1_sig.py16CODE
LOWprojects/pygments/fuzz_lexers.py21CODE
LOWprojects/mako/fuzz_lexer.py15CODE
LOWprojects/retry/fuzz_retry.py19CODE
LOWprojects/decorator/fuzz_decorator.py18CODE
LOWprojects/decorator/fuzz_decorator.py20CODE
LOWprojects/decorator/fuzz_funcmarker.py18CODE
LOWprojects/decorator/fuzz_funcmarker.py20CODE
LOWprojects/dask/fuzz_fuse.py18CODE
LOWprojects/g-api-py-oauthlib/fuzz_config.py16CODE
LOWprojects/docutils/fuzz_rst.py24CODE
LOWprojects/docutils/fuzz_rst.py25CODE
LOWprojects/docutils/fuzz_rst.py25CODE
LOWprojects/abseil-py/fuzz_argparse.py22CODE
LOWprojects/et-xmlfile/fuzz_write.py16CODE
LOWprojects/et-xmlfile/fuzz_write.py22CODE
LOWprojects/pyparsing/fuzz_parse.py16CODE
LOWprojects/angle/gen_clones.py17CODE
LOWprojects/grpc-py/fuzz_server.py21CODE
LOWprojects/grpc-py/fuzz_server.py27CODE
290 more matches not shown…
Hyper-Verbose Identifiers280 hits · 294 pts
SeverityFileLineSnippetContext
LOWinfra/repo_manager_test.py45 def test_clone_valid_repo_integration(self):CODE
LOWinfra/repo_manager_test.py79 def test_checkout_valid_commit(self):CODE
LOWinfra/repo_manager_test.py87 def test_checkout_invalid_commit(self):CODE
LOWinfra/repo_manager_test.py104 def test_get_valid_commit_list(self):CODE
LOWinfra/repo_manager_test.py119 def test_get_invalid_commit_list(self):CODE
LOWinfra/repo_manager_test.py188 def test_checkout_invalid_pull_request(self):CODE
LOWinfra/pr_helper_test.py97 def test_save_env_newline_injection_blocked(self):CODE
LOWinfra/pr_helper_test.py105 def test_save_env_carriage_return_injection_blocked(self):CODE
LOWinfra/pr_helper_test.py112 def test_save_env_injection_via_all_fields(self):CODE
LOWinfra/pr_helper_test.py120 def test_save_env_none_values(self, mock_uuid):CODE
LOWinfra/pr_helper_test.py129 def test_save_env_full_attack_scenario(self):CODE
LOWinfra/pr_helper_test.py165 def test_url_with_newline_injection(self):CODE
LOWinfra/pr_helper_test.py172 def test_url_with_carriage_return(self):CODE
LOWinfra/pr_helper_test.py195 def test_invalid_scheme_rejected(self):CODE
LOWinfra/pr_helper_test.py201 def test_ssh_url_with_newline_injection(self):CODE
LOWinfra/pr_helper_test.py212 def test_primary_contact_match(self):CODE
LOWinfra/helper_test.py139 def test_generate_oss_fuzz_project(self, _):CODE
LOWinfra/helper_test.py148 def test_generate_external_project(self):CODE
LOWinfra/helper_test.py161 def test_generate_swift_project(self, _):CODE
LOWinfra/helper_test.py181 def test_init_external_project(self):CODE
LOWinfra/helper_test.py190 def test_init_internal_project(self):CODE
LOWinfra/helper_test.py197 def test_dockerfile_path_internal_project(self):CODE
LOWinfra/helper_test.py204 def test_dockerfile_path_external_project(self):CODE
LOWinfra/helper_test.py236 def test_language_internal_project(self):CODE
LOWinfra/helper_test.py242 def test_language_external_project(self):CODE
LOWinfra/repo_manager.py235def clone_repo_and_get_manager(repo_url,CODE
LOWinfra/build_specified_commit.py104def _replace_base_builder_digest(dockerfile_path, digest):CODE
LOWinfra/build_specified_commit.py147def _build_image_with_retries(project_name):CODE
LOWinfra/build_specified_commit.py152def get_required_post_checkout_steps(dockerfile_path):CODE
LOWinfra/build_specified_commit.py180def build_fuzzers_from_commit(commit,CODE
LOWinfra/presubmit.py50def _check_one_lib_fuzzing_engine(build_sh_file):CODE
LOWinfra/presubmit.py157 def check_project_yaml_constants(self):CODE
LOWinfra/presubmit.py179 def check_valid_section_names(self):CODE
LOWinfra/helper.py210def _add_external_project_args(parser):CODE
LOWinfra/helper.py939def _add_oss_fuzz_ci_if_needed(env):CODE
LOWinfra/helper.py1051def _get_latest_public_corpus(args, fuzzer):CODE
LOWinfra/helper.py1129 def _download_for_single_target(fuzz_target):CODE
LOWinfra/helper.py1222def _introspector_prepare_corpus(args):CODE
LOWinfra/helper.py1556def _create_build_integration_directory(directory):CODE
LOWinfra/helper.py1591def _base_builder_from_language(language):CODE
LOWinfra/pr_helper.py235 def get_integrated_project_info(self):CODE
LOWinfra/pr_helper.py304 def is_author_internal_member(self):CODE
LOWinfra/pr_helper.py308 def has_author_modified_project(self, project_path):CODE
LOWinfra/build_specified_commit_test.py39 def test_build_fuzzers_from_commit(self):CODE
LOWinfra/build_specified_commit_test.py81 def test_detect_main_repo_from_commit(self):CODE
LOWinfra/build_specified_commit_test.py101 def test_detect_main_repo_from_name(self):CODE
LOWinfra/chronos/integrity_validator_check_replay.py51def source_code_compile_error():CODE
LOWinfra/chronos/integrity_validator_run_tests.py36def _add_payload_random_functions(exts: list[str], payload: str) -> str:CODE
LOWinfra/chronos/coverage_test_collection.py26def collect_coverage_profraw_files():CODE
LOWinfra/chronos/manager.py39def _get_project_cached_named(project: common_utils.Project,CODE
LOWinfra/chronos/manager.py46def _get_project_cached_named_local(project: common_utils.Project,CODE
LOWinfra/chronos/manager.py422def cmd_dispatcher_check_tests(args):CODE
LOWinfra/chronos/manager.py430def cmd_dispatcher_check_replay(args):CODE
LOWinfra/chronos/manager.py437def cmd_dispatcher_build_cached_image(args):CODE
LOWinfra/chronos/manager.py442def cmd_dispatcher_extract_coverage(args):CODE
LOWinfra/experimental/agent-skills/helper.py822def cleanup_project_artifacts(project):STRING
LOWinfra/experimental/agent-skills/helper.py921def _run_single_integrate_session(agent_cli, project_url):CODE
LOWinfra/experimental/agent-skills/helper.py1136def build_consolidation_prompt(project):CODE
LOWinfra/experimental/agent-skills/helper.py1149def launch_consolidation_session(agent_cli, project):CODE
LOWinfra/experimental/agent-skills/helper.py1188def _run_single_consolidation_session(agent_cli, project):CODE
220 more matches not shown…
Cross-Language Confusion29 hits · 182 pts
SeverityFileLineSnippetContext
HIGHinfra/templates.py44RUN apt-get update && apt-get install -y make autoconf automake libtoolCODE
HIGHinfra/templates.py52RUN apt-get update && apt-get install -y make autoconf automake libtoolCODE
HIGHinfra/chronos/manager.py176 base_cmd = 'export PATH=/ccache/bin:$PATH && rm -rf /out/* && compile'CODE
HIGHinfra/experimental/agent-skills/helper.py983 print(f' cd {OSS_FUZZ_ROOT} && git diff && git status')CODE
HIGHinfra/experimental/mcp/client.py659cd $GOPATH/src/$path || trueCODE
HIGHinfra/experimental/mcp/client.py661go mod tidy || trueCODE
HIGHinfra/experimental/mcp/client.py665go list $tags $path || { go mod init $path && go mod tidy ;}CODE
HIGHinfra/experimental/mcp/client.py679 abspath_repo=`go list -m $tags -f {{.Dir}} $fuzzed_repo || go list $tags -f {{.Dir}} $fuzzed_repo`CODE
HIGHinfra/experimental/mcp/client.py688 abspath_repo=`go list -m $tags -f {{.Dir}} $GO_COV_ADD_PKG || go list $tags -f {{.Dir}} $GO_COV_ADD_PKG`CODE
HIGHinfra/experimental/mcp/client.py850RUN apt-get update && apt-get install -y make autoconf automake libtoolCODE
HIGHinfra/experimental/contrib/arvo/arvo_reproducer.py641 f"git reset --hard $commit || exit 99) ; "CODE
HIGHinfra/experimental/contrib/arvo/arvo_reproducer.py642 f"(git submodule init && git submodule update --force) ;popd'")CODE
HIGHinfra/experimental/contrib/arvo/arvo_reproducer.py649 f"git reset --hard $commit || exit 99) ; "CODE
HIGHinfra/experimental/contrib/arvo/arvo_reproducer.py650 f"(git submodule init && git submodule update --force) ;popd'")CODE
HIGHinfra/experimental/contrib/arvo/arvo_data.py73 r'RUN apt', "RUN apt update -y && apt install git ca-certificates -y && "CODE
HIGHinfra/experimental/contrib/arvo/hacks/imagemagick.py14 "RUN mkdir /src/heic_corpus && touch /src/heic_corpus/XxX")CODE
HIGHinfra/experimental/contrib/arvo/hacks/libreoffice.py42 line, 'echo "pushd instdir/program && mv *fuzzer $OUT" >> 'CODE
HIGHinfra/cifuzz/continuous_integration_test.py66 'cp -r /path/on/host/to/repo /src && cd - 'CODE
HIGHprojects/freeradius/generate_seeds.py470 " if ((1 + 2) > 2 || 0) { ok }\n"CODE
HIGHprojects/freeradius/generate_seeds.py711 b'{"a":1,"b":2.5,"c":true,"d":null,"e":false}',CODE
HIGHprojects/freeradius/generate_seeds.py713 b'[1,2,3,4,5,"six",7.0,8e3,-9,true,false,null]',CODE
HIGHprojects/yyjson/generate_patch_corpora.py126 "{\"op\":\"add\",\"path\":null,\"value\":2}]"),CODE
HIGHprojects/yyjson/generate_patch_corpora.py203 ("{\"a\":\"b\"}", "{\"a\":null }"),CODE
HIGHprojects/yyjson/generate_patch_corpora.py204 ("{\"a\":\"b\"}", "{\"a\":null }"),CODE
HIGHprojects/yyjson/generate_patch_corpora.py205 ("{\"a\":\"b\", \"b\":\"c\"}", "{\"a\":null }"),CODE
HIGHprojects/yyjson/generate_patch_corpora.py208 ("{\"a\":{\"b\":\"c\"}}", "{\"a\":{\"b\":\"d\",\"c\":null}}"),CODE
HIGHprojects/yyjson/generate_patch_corpora.py214 ("{\"e\":null}", "{\"a\":1}"),CODE
HIGHprojects/yyjson/generate_patch_corpora.py215 ("[1,2]", "{\"a\":\"b\",\"c\":null}"),CODE
HIGHprojects/yyjson/generate_patch_corpora.py216 ("{}", "{\"a\":{\"bb\":{\"ccc\":null}}}"),CODE
Cross-File Repetition29 hits · 145 pts
SeverityFileLineSnippetContext
HIGHinfra/cifuzz/clusterfuzz_deployment_test.py0creates a config object from |config_cls| and then sets every attribute that is a key in |kwargs| to the corresponding vSTRING
HIGHinfra/cifuzz/fuzz_target_test.py0creates a config object from |config_cls| and then sets every attribute that is a key in |kwargs| to the corresponding vSTRING
HIGHinfra/cifuzz/test_helpers.py0creates a config object from |config_cls| and then sets every attribute that is a key in |kwargs| to the corresponding vSTRING
HIGHinfra/cifuzz/filestore/__init__.py0uploads the coverage report at |directory| to |name|.STRING
HIGHinfra/cifuzz/filestore/gsutil/__init__.py0uploads the coverage report at |directory| to |name|.STRING
HIGHinfra/cifuzz/filestore/filesystem/__init__.py0uploads the coverage report at |directory| to |name|.STRING
HIGHinfra/cifuzz/filestore/github_actions/__init__.py0uploads the coverage report at |directory| to |name|.STRING
HIGHinfra/cifuzz/filestore/git/__init__.py0uploads the coverage report at |directory| to |name|.STRING
HIGHinfra/cifuzz/filestore/__init__.py0downloads the corpus located at |name| to |dst_directory|.STRING
HIGHinfra/cifuzz/filestore/gsutil/__init__.py0downloads the corpus located at |name| to |dst_directory|.STRING
HIGHinfra/cifuzz/filestore/filesystem/__init__.py0downloads the corpus located at |name| to |dst_directory|.STRING
HIGHinfra/cifuzz/filestore/github_actions/__init__.py0downloads the corpus located at |name| to |dst_directory|.STRING
HIGHinfra/cifuzz/filestore/git/__init__.py0downloads the corpus located at |name| to |dst_directory|.STRING
HIGHinfra/cifuzz/filestore/__init__.py0downloads the build with name |name| to |dst_directory|.STRING
HIGHinfra/cifuzz/filestore/gsutil/__init__.py0downloads the build with name |name| to |dst_directory|.STRING
HIGHinfra/cifuzz/filestore/filesystem/__init__.py0downloads the build with name |name| to |dst_directory|.STRING
HIGHinfra/cifuzz/filestore/git/__init__.py0downloads the build with name |name| to |dst_directory|.STRING
HIGHinfra/cifuzz/filestore/github_actions/__init__.py0downloads the build with name |name| to |dst_directory|.STRING
HIGHinfra/cifuzz/platform_config/standalone.py0returns the filestore used to store persistent data.STRING
HIGHinfra/cifuzz/platform_config/gitlab.py0returns the filestore used to store persistent data.STRING
HIGHinfra/cifuzz/platform_config/__init__.py0returns the filestore used to store persistent data.STRING
HIGHinfra/cifuzz/platform_config/gcb.py0returns the filestore used to store persistent data.STRING
HIGHinfra/cifuzz/platform_config/prow.py0returns the filestore used to store persistent data.STRING
HIGHinfra/cifuzz/platform_config/__init__.py0returns the base commit to diff against (commit fuzzing).STRING
HIGHinfra/cifuzz/platform_config/prow.py0returns the base commit to diff against (commit fuzzing).STRING
HIGHinfra/cifuzz/platform_config/github.py0returns the base commit to diff against (commit fuzzing).STRING
HIGHinfra/cifuzz/platform_config/__init__.py0returns the base branch to diff against (pr fuzzing).STRING
HIGHinfra/cifuzz/platform_config/prow.py0returns the base branch to diff against (pr fuzzing).STRING
HIGHinfra/cifuzz/platform_config/github.py0returns the base branch to diff against (pr fuzzing).STRING
AI Slop Vocabulary42 hits · 128 pts
SeverityFileLineSnippetContext
MEDIUMinfra/experimental/agent-skills/helper.py1695 # Single focused harness per project (no summary by default):COMMENT
MEDIUMinfra/experimental/mcp/client.py117# Build fuzz harness.COMMENT
LOW…es/base-builder/sanitizers/pysecsan/pysecsan/sanlib.py155 # Otherwise, just return attribute of instanceCOMMENT
MEDIUMinfra/cifuzz/build_fuzzers.py14"""Module used by CI tools in order to interact with fuzzers. This module helpsSTRING
MEDIUMprojects/freeradius/generate_seeds.py827 # inside the harness, so emit each string under a spread of selector bytes.COMMENT
MEDIUMprojects/freeradius/generate_seeds.py920 except Exception as e: # keep build robustCODE
MEDIUMprojects/wolfssh/build.sh56# Build the fuzzer harnessCOMMENT
MEDIUMprojects/libheif/generate_seeds.py514 except Exception as e: # keep build robustCODE
MEDIUMprojects/connectedhomeip/build.sh123 # The FuzzChipCert harness seeds from a source-tree directory that is not present in theCOMMENT
MEDIUMprojects/connectedhomeip/build.sh126 # target -- so libFuzzer uses them as the initial corpus. (The harness itself tolerates theCOMMENT
MEDIUMprojects/postcss/build.sh36# Build Fuzzers. The harness lives upstream at test/fuzzing/fuzz_parse.jsCOMMENT
MEDIUMprojects/libpg_query/build.sh22# Protobuf parse + deparse + fingerprint/normalize/scan harnessCOMMENT
MEDIUMprojects/libpg_query/build.sh26# PL/pgSQL function-body parser harness (separate grammar/scanner)COMMENT
MEDIUMprojects/tdengine/build.sh51# Compile the fuzzer harnessCOMMENT
MEDIUMprojects/libiec61850/build.sh26# Build every harness in the upstream fuzz/ directory.COMMENT
MEDIUMprojects/vlc/build.sh198# libFuzzer's ParseDictionaryFile rejects such lines, breaking the generic harness.COMMENT
MEDIUMprojects/vlc/build.sh219# Write an options file to disable leak for the general harnessCOMMENT
MEDIUMprojects/vlc/generate_seeds.py1706# registered in the fuzz harness, so codec/telx.c is entirely absent from theCOMMENT
MEDIUMprojects/vlc/generate_seeds.py4352# the H.264/H.265 packetizers — the test harness discards packetizer pf_get_ccCOMMENT
MEDIUMprojects/vlc/generate_seeds.py4599# The harness forces the "mod" demuxer by name, so demux->obj.force is true andCOMMENT
MEDIUMprojects/vlc/generate_seeds.py2667 # The libfuzzer harness picks the demuxer module from the binary-nameCOMMENT
MEDIUMprojects/vlc/generate_seeds.py2709 # Round 2 — comprehensive event stream. The previous seeds covered only aCOMMENT
MEDIUMprojects/vlc/generate_seeds.py4790 # never registered in the harness (absent from coverage). A structurallyCOMMENT
MEDIUMprojects/dcmtk/build.sh49# Derive robust link set from pkg-config and filter to installed libs.COMMENT
MEDIUMprojects/qemu/replay_build.sh68 # Skip generic harness.COMMENT
MEDIUMprojects/rapidjson/build.sh30# Build fuzz harness.COMMENT
MEDIUMprojects/duckdb/build.sh19# json_extract), which the csv_json harness exercises; parquet is built byCOMMENT
MEDIUMprojects/duckdb/build.sh25# Patch the csv_json harness to force-load the statically-linked json extension.COMMENT
MEDIUMprojects/duckdb/build.sh27# The upstream harness (test/ossfuzz/csv_json_fuzz_test.cpp) exercises the jsonCOMMENT
MEDIUMprojects/duckdb/build.sh37# harness upstream (duckdb/duckdb test/ossfuzz/csv_json_fuzz_test.cpp).COMMENT
MEDIUMprojects/duckdb/build.sh44# harness whose JSON cases are dead.COMMENT
MEDIUMprojects/duckdb/build.sh50# Build each OSS-Fuzz harness in test/ossfuzz/ against the statically-linkedCOMMENT
MEDIUMprojects/gstreamer/generate_seeds.py92 # A few profile/tier/level variants. (Empirically the harness's h264/h265COMMENT
MEDIUMprojects/gstreamer/generate_seeds.py114 # --- Opus header tail (harness prepends "OpusHead\x01").COMMENT
MEDIUMprojects/gstreamer/generate_seeds.py355 # comprehensive multi-IFD EXIF (main + Exif sub-IFD + GPS sub-IFD): hitsCOMMENT
MEDIUMprojects/ipmi-fru-parser/build.sh80# Compile fuzz harnessCOMMENT
MEDIUMprojects/wolftpm/build.sh52# Build the fuzz harness, linking wolftpm + wolfssl statically.COMMENT
LOWprojects/esp-v2/build.sh141# TODO(nareddyt): just use the .tar directly whenCOMMENT
MEDIUMprojects/imagemagick/run_tests.sh22# interface for comprehensive testing of ImageMagick.COMMENT
MEDIUMprojects/nsmd/build.sh36# Compile and link each C++ fuzzer harness into a separate executableCOMMENT
MEDIUMprojects/wolfboot/build.sh55# Fold the two extra parser objects into libwolfboot.a so the harnessCOMMENT
MEDIUMprojects/wolfboot/build.sh59# Harness compile/link. Each harness builds against the parser interfaceCOMMENT
Hallucination Indicators12 hits · 120 pts
SeverityFileLineSnippetContext
CRITICAL…ects/jackson-datatype-joda/JodaDeserializerFuzzer.java53 mapper = tools.jackson.databind.json.JsonMapper.builder()CODE
CRITICAL…ojects/jackson-datatype-joda/JodaSerializerFuzzer.java39 mapper = tools.jackson.databind.json.JsonMapper.builder()CODE
CRITICAL…ojects/jackson-datatype-joda/JodaSerializerFuzzer.java49 mapper = tools.jackson.databind.json.JsonMapper.builder()CODE
CRITICAL…/org/apache/struts/test/StrutsSimpleRequestFuzzer.java41 com.code_intelligence.jazzer.api.BugDetectors.allowNetworkConnections();CODE
CRITICAL…rc/main/java/ossfuzz/ConfigServerPropertiesFuzzer.java33 ConfigServerProperties config = new org.springframework.cloud.config.server.config.ConfigServerProperties();CODE
CRITICALprojects/powsybl-java/ParseFuzzer.java176 "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\""CODE
CRITICALprojects/powsybl-java/DeserializeFuzzer.java295 "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\""CODE
CRITICALprojects/powsybl-java/MetrixFuzzer.java300 "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\""CODE
CRITICALprojects/powsybl-java/LoadFlowFuzzer.java252 "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\""CODE
CRITICALprojects/powsybl-java/OpenRaoFuzzer.java142 "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\""CODE
CRITICALprojects/swagger-core/YamlFuzzer.java26 io.swagger.v3.core.util.Yaml31.jsonSchemaAsMap(data.consumeRemainingAsString());CODE
CRITICAL…nit-fuzzer/src/main/java/ossfuzz/HtmlParserFuzzer.java48 com.code_intelligence.jazzer.api.BugDetectors.allowNetworkConnections();CODE
Deep Nesting80 hits · 78 pts
SeverityFileLineSnippetContext
LOWinfra/retry.py36CODE
LOWinfra/retry.py47CODE
LOWinfra/retry.py70CODE
LOWinfra/retry.py86CODE
LOWinfra/presubmit.py157CODE
LOWinfra/helper.py116CODE
LOWinfra/pr_helper.py95CODE
LOWinfra/bisector.py177CODE
LOWinfra/common_utils.py227CODE
LOWinfra/chronos/integrity_validator_check_replay.py30CODE
LOWinfra/chronos/integrity_validator_check_replay.py51CODE
LOWinfra/chronos/integrity_validator_check_replay.py69CODE
LOWinfra/chronos/integrity_validator_check_replay.py87CODE
LOWinfra/chronos/integrity_validator_check_replay.py124CODE
LOWinfra/chronos/integrity_validator_check_replay.py178CODE
LOWinfra/chronos/integrity_validator_run_tests.py36CODE
LOWinfra/chronos/integrity_validator_run_tests.py116CODE
LOWinfra/chronos/integrity_validator_run_tests.py221CODE
LOWinfra/chronos/coverage_test_collection.py38CODE
LOWinfra/chronos/manager.py193CODE
LOWinfra/experimental/agent-skills/helper.py986CODE
LOWinfra/experimental/agent-skills/helper.py1530CODE
LOWinfra/experimental/mcp/client.py422CODE
LOWinfra/experimental/mcp/client.py946CODE
LOWinfra/experimental/mcp/oss_fuzz_server.py186CODE
LOWinfra/experimental/mcp/oss_fuzz_server.py544CODE
LOWinfra/experimental/contrib/arvo/arvo_reproducer.py192CODE
LOWinfra/experimental/contrib/arvo/arvo_reproducer.py575CODE
LOWinfra/experimental/contrib/arvo/arvo_reproducer.py768CODE
LOWinfra/experimental/contrib/arvo/arvo_utils.py176CODE
LOWinfra/experimental/contrib/arvo/arvo_utils.py612CODE
LOWinfra/ci/check_base_os.py43CODE
LOW…base-images/base-runner/python_coverage_runner_help.py83CODE
LOWinfra/base-images/base-runner/test_all.py70CODE
LOW…fra/base-images/base-builder/python_coverage_helper.py25CODE
LOWinfra/base-images/base-builder/unshallow_repos.py25CODE
LOWinfra/base-images/base-builder/detect_repo.py74CODE
LOW…lder/sanitizers/pysecsan/pysecsan/command_injection.py36CODE
LOW…fra/base-images/base-builder/indexer/manifest_types.py399CODE
LOWinfra/base-images/base-builder/indexer/dwarf_info.py50CODE
LOWinfra/base-images/base-builder/indexer/clang_wrapper.py322CODE
LOW…a/base-images/base-builder/indexer/index_build_test.py79CODE
LOWinfra/base-images/base-builder/indexer/index_build.py164CODE
LOWinfra/base-images/base-builder/indexer/index_build.py312CODE
LOWinfra/base-images/base-builder/indexer/index_build.py729CODE
LOWinfra/cifuzz/fuzz_target.py167CODE
LOWinfra/cifuzz/config_utils.py241CODE
LOWinfra/cifuzz/config_utils.py203CODE
LOWinfra/cifuzz/config_utils.py335CODE
LOWprojects/paramiko/fuzz_packetizer.py39CODE
LOWprojects/libheif/generate_seeds.py306CODE
LOWprojects/ffmpeg/group_seed_corpus.py30CODE
LOWprojects/ffmpeg/group_seed_corpus.py90CODE
LOWprojects/pyrsistent/fuzz_vector.py23CODE
LOWprojects/pyparsing/fuzz_parse.py30CODE
LOWprojects/angle/gen_clones.py20CODE
LOWprojects/vlc/generate_seeds.py4782CODE
LOWprojects/vlc/generate_seeds.py5276CODE
LOWprojects/vlc/generate_seeds.py4839CODE
LOWprojects/vlc/generate_seeds.py4937CODE
20 more matches not shown…
Excessive Try-Catch Wrapping70 hits · 76 pts
SeverityFileLineSnippetContext
LOWinfra/retry.py81 except Exception as error:CODE
LOWinfra/retry.py98 except Exception as error:CODE
MEDIUMinfra/presubmit.py62 print('Error: build.sh contains deprecated "-lFuzzingEngine" on line: 'CODE
MEDIUMinfra/presubmit.py145 print(f'Error in {self.filename}: {message}')CODE
LOWinfra/helper.py1136 except Exception as error: # pylint:disable=broad-exceptCODE
MEDIUMinfra/helper.py1129def _download_for_single_target(fuzz_target):CODE
MEDIUMinfra/bisector.py119 print('Error was introduced at commit %s' % result.commit)CODE
MEDIUMinfra/bisector.py121 print('Error was fixed at commit %s' % result.commit)CODE
LOWinfra/chronos/integrity_validator_check_replay.py47 except Exception:CODE
LOWinfra/chronos/integrity_validator_check_replay.py65 except Exception:CODE
LOWinfra/chronos/integrity_validator_check_replay.py83 except Exception:CODE
LOWinfra/chronos/integrity_validator_check_replay.py120 except Exception:CODE
LOWinfra/chronos/integrity_validator_check_replay.py154 except Exception:CODE
LOWinfra/chronos/integrity_validator_check_replay.py174 except Exception:CODE
LOWinfra/chronos/integrity_validator_check_replay.py209 except Exception:CODE
LOWinfra/chronos/integrity_validator_run_tests.py59 except Exception:CODE
LOWinfra/chronos/integrity_validator_run_tests.py89 except Exception:CODE
LOWinfra/chronos/integrity_validator_run_tests.py143 except Exception:CODE
LOWinfra/chronos/integrity_validator_run_tests.py180 except Exception:CODE
LOWinfra/experimental/mcp/client.py206 except Exception as e:STRING
LOWinfra/experimental/mcp/oss_fuzz_server.py378 except Exception as e:CODE
LOWinfra/experimental/mcp/oss_fuzz_server.py404 except Exception as e:CODE
LOWinfra/experimental/mcp/oss_fuzz_server.py435 except Exception as e:CODE
LOWinfra/experimental/mcp/oss_fuzz_server.py451 except Exception as e:CODE
LOWinfra/experimental/mcp/oss_fuzz_server.py478 except Exception as e:CODE
LOWinfra/experimental/mcp/oss_fuzz_server.py506 except Exception as e:CODE
LOWinfra/experimental/contrib/arvo/arvo_reproducer.py185 except Exception:CODE
LOWinfra/experimental/contrib/arvo/arvo_reproducer.py1045 except Exception:CODE
MEDIUMinfra/ci/check_base_os.py74 print(f'Error: Dockerfile not found at {dockerfile_path}', file=sys.stderr)CODE
MEDIUMinfra/ci/check_base_os.py89 print(f'Error: Could not parse tag from Dockerfile FROM line: {line}',CODE
LOW…r/sanitizers/pysecsan/pysecsan/yaml_deserialization.py23except Exception:CODE
LOW…fra/base-images/base-builder/indexer/manifest_types.py539 except Exception as e: # pylint: disable=broad-exceptCODE
LOWinfra/base-images/base-builder/indexer/index_build.py714 except Exception: # pylint: disable=broad-exception-caughtCODE
LOWinfra/cifuzz/clusterfuzz_deployment.py136 except Exception as err: # pylint: disable=broad-exceptCODE
LOWinfra/cifuzz/clusterfuzz_deployment.py150 except Exception as err: # pylint: disable=broad-exceptCODE
LOWinfra/cifuzz/clusterfuzz_deployment.py169 except Exception as err: # pylint: disable=broad-exceptCODE
LOWinfra/cifuzz/clusterfuzz_deployment.py181 except Exception as err: # pylint: disable=broad-exceptCODE
LOWinfra/cifuzz/clusterfuzz_deployment.py203 except Exception as err: # pylint: disable=broad-exceptCODE
LOWinfra/cifuzz/clusterfuzz_deployment.py221 except Exception as err: # pylint: disable=broad-exceptCODE
LOWinfra/cifuzz/http_utils.py72 except Exception: # pylint: disable=broad-exceptCODE
LOWinfra/cifuzz/config_utils.py232 except Exception: # pylint: disable=broad-exceptCODE
LOWprojects/freeradius/generate_seeds.py920 except Exception as e: # keep build robustCODE
LOWprojects/flask/cors_fuzz_flask.py78 except Exception:CODE
LOWprojects/flask/cors_fuzz_flask.py89 except Exception as e:CODE
LOWprojects/aiohttp/fuzz_web_request.py34 except Exception:CODE
LOWprojects/libheif/generate_seeds.py514 except Exception as e: # keep build robustCODE
LOWprojects/ujson/json_differential_fuzzer.py70 except Exception as e:CODE
LOWprojects/g-api-python-cloud-core/fuzz_helpers.py31 except Exception:CODE
LOWprojects/attrs/fuzz_attrs.py39 except Exception as e:CODE
LOWprojects/decorator/fuzz_funcmarker.py35 except Exception as e:CODE
LOWprojects/jinja2/fuzz_env_jinja_lexer.py33 except Exception as e2:CODE
LOWprojects/python-prompt-toolkit/fuzz_contrib.py27 except Exception as e:CODE
LOWprojects/g-api-auth-httplib2/fuzz_http.py109 except Exception as e:CODE
LOWprojects/sqlalchemy/sqlalchemy_fuzzer.py42 except Exception as e:CODE
MEDIUMprojects/sqlalchemy/sqlalchemy_fuzzer.py27def TestOneInput(input_bytes):CODE
LOWprojects/vlc/generate_seeds.py4976 except Exception as e: # pragma: no cover - Pillow optionalCODE
LOWprojects/vlc/generate_seeds.py4993 except Exception:CODE
LOWprojects/joblib/fuzz_serialization_roundtrip.py28 except Exception as e:CODE
LOWprojects/kafka/fuzz_consumer.py33 except Exception as e:CODE
LOWprojects/python-pypdf/fuzz_encryption.py54 except Exception:CODE
10 more matches not shown…
Docstring Block Structure9 hits · 45 pts
SeverityFileLineSnippetContext
HIGHinfra/repo_manager.py141Gets the list of commits(inclusive) between the old and new commits. Args: newest_commit: The newest commit tSTRING
HIGHinfra/utils.py56Runs a shell command in the specified directory location. Args: command: The command as a list to be run. envSTRING
HIGHinfra/bisector.py289From a commit range, this function caluclates which introduced a specific error from a fuzz testcase_path. Args: STRING
HIGHinfra/base-images/base-builder/detect_repo.py157Runs a shell command in the specified directory location. Args: command: The command as a list to be run. locSTRING
HIGH…fra/base-images/base-builder/indexer/manifest_types.py410Saves a build archive with this Manifest. Args: source_dir: The directory containing the source code, or NoneSTRING
HIGH…fra/base-images/base-builder/indexer/manifest_types.py637Helper function to parse environment variables from a list. Args: env_list: A list of environment variables in thSTRING
HIGHinfra/base-images/base-builder/indexer/dwarf_info.py128Parses the value of a `-frecord-command-line` entry from clang. Separate arguments within a command line are combineSTRING
HIGHinfra/cifuzz/fuzz_target.py285Checks if the testcase reproduces. Args: testcase: The path to the testcase to be tested. target_STRING
HIGHinfra/cifuzz/fuzz_target.py334Returns True if a crash is reportable. This means the crash is reproducible but not reproducible on a build from theSTRING
Structural Annotation Overuse22 hits · 44 pts
SeverityFileLineSnippetContext
LOWinfra/experimental/chronos/build_cache_local.sh30# Step 1: build the base imageCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh35# Step 2: create a container where `compile` has run which enables ccachingCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh57# Step 3: save (commit, locally) the cached container as an imageCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh67# Step 4: save the list of executables created from a vanilla build. This isCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh74# Step 5: Build with replay enabled, and validate the executables are the sameCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh118# Step 8: prepare Dockerfile for ccacheCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh125# Step 9: Build an image with CCache's new items (modifications are done on theCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh131# Step 10: Run a `compile` with ccache's image.COMMENT
LOWinfra/experimental/chronos/build_cache_local.sh145# Step 11: extract the executables from the ccache buildCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh149# Step 12: validate the ccache builds are successfulCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh90# Step 6: Extract the newly build executablesCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh102# Step 7: match executables from vanilla builds and replay builds.COMMENT
LOWinfra/experimental/chronos/check_tests.sh32# Step 1: build the base imageCOMMENT
LOWinfra/experimental/chronos/check_tests.sh36# Step 2: create a container where `compile` has run which enables ccachingCOMMENT
LOWinfra/experimental/chronos/check_tests.sh58# Step 3: save (commit, locally) the cached container as an imageCOMMENT
LOWinfra/experimental/chronos/check_tests.sh62# Step 4: run the actual run_tests.sh script in the container.COMMENT
LOWinfra/experimental/contrib/arvo/arvo_reproducer.py148 # Step 1: Get the token from the cookieCOMMENT
LOWprojects/ruby/build.sh21# Step 1: Download and install latest stable Ruby release as baserubyCOMMENT
LOWprojects/ruby/build.sh58# Step 2: Build target Ruby from source with static linkingCOMMENT
LOWprojects/ruby/build.sh119# Step 3: Set up paths for fuzzer buildsCOMMENT
LOWdocs/getting-started/new-project-guide/jvm_lang.md104# Step 1: Build the projectCOMMENT
LOWdocs/getting-started/new-project-guide/jvm_lang.md119# Step 2: Build the fuzzers (should not require any changes)COMMENT
Verbosity Indicators20 hits · 41 pts
SeverityFileLineSnippetContext
LOWinfra/experimental/chronos/build_cache_local.sh30# Step 1: build the base imageCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh35# Step 2: create a container where `compile` has run which enables ccachingCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh57# Step 3: save (commit, locally) the cached container as an imageCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh67# Step 4: save the list of executables created from a vanilla build. This isCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh74# Step 5: Build with replay enabled, and validate the executables are the sameCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh118# Step 8: prepare Dockerfile for ccacheCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh125# Step 9: Build an image with CCache's new items (modifications are done on theCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh131# Step 10: Run a `compile` with ccache's image.COMMENT
LOWinfra/experimental/chronos/build_cache_local.sh145# Step 11: extract the executables from the ccache buildCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh149# Step 12: validate the ccache builds are successfulCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh90# Step 6: Extract the newly build executablesCOMMENT
LOWinfra/experimental/chronos/build_cache_local.sh102# Step 7: match executables from vanilla builds and replay builds.COMMENT
LOWinfra/experimental/chronos/check_tests.sh32# Step 1: build the base imageCOMMENT
LOWinfra/experimental/chronos/check_tests.sh36# Step 2: create a container where `compile` has run which enables ccachingCOMMENT
LOWinfra/experimental/chronos/check_tests.sh58# Step 3: save (commit, locally) the cached container as an imageCOMMENT
LOWinfra/experimental/chronos/check_tests.sh62# Step 4: run the actual run_tests.sh script in the container.COMMENT
LOWinfra/experimental/contrib/arvo/arvo_reproducer.py148 # Step 1: Get the token from the cookieCOMMENT
LOWprojects/ruby/build.sh21# Step 1: Download and install latest stable Ruby release as baserubyCOMMENT
LOWprojects/ruby/build.sh58# Step 2: Build target Ruby from source with static linkingCOMMENT
LOWprojects/ruby/build.sh119# Step 3: Set up paths for fuzzer buildsCOMMENT
Redundant / Tautological Comments22 hits · 35 pts
SeverityFileLineSnippetContext
LOWinfra/chronos/integrity_validator_run_tests.py238 # Check if there is a .git directoryCOMMENT
LOWinfra/experimental/chronos/chronos.sh53 # Check if any element in the command array contains the FUZZ_TARGET.COMMENT
LOWinfra/experimental/agent-skills/copy_to_global.sh41# Check if the global skills directory exists, if not create itCOMMENT
LOW…base-images/base-runner/python_coverage_runner_help.py59 # Check if this file exists in our file paths:COMMENT
LOW…fra/base-images/base-builder/python_coverage_helper.py43 # Check if .egg is in the path and if so we need to split itCOMMENT
LOWinfra/base-images/base-builder/detect_repo.py142 # Check if valid git repo.COMMENT
LOWinfra/base-images/base-builder/detect_repo.py146 # Check if history fetch is needed.COMMENT
LOWinfra/base-images/base-builder/detect_repo.py150 # Check if commit is in history.COMMENT
LOW…lder/sanitizers/pysecsan/pysecsan/command_injection.py79 # Check if the arguments are controlled by the fuzzer, and this givenCOMMENT
LOW…base-clang/checkout_build_install_llvm_ubuntu_20_04.sh20# Set this to get a full build with all binaries and libraries, as well asCOMMENT
LOW…base-clang/checkout_build_install_llvm_ubuntu_24_04.sh20# Set this to get a full build with all binaries and libraries, as well asCOMMENT
LOW…/base-images/base-clang/checkout_build_install_llvm.sh20# Set this to get a full build with all binaries and libraries, as well asCOMMENT
LOWinfra/cifuzz/config_utils.py119 self.dry_run = _is_dry_run() # Check if failures should not be reported.CODE
LOWprojects/lit/build.sh21 # Check if the file contains the "type" fieldCOMMENT
LOWprojects/canvg/build.sh45 # Check if the file contains the "type" fieldCOMMENT
LOWprojects/angular/build.sh21 # Check if the file contains the "type" fieldCOMMENT
LOWprojects/angular/build.sh79 # Check if the file has the "mjs" extensionCOMMENT
LOWprojects/d3/build.sh21 # Check if the file contains the "type" fieldCOMMENT
LOWprojects/libssh/build.sh58 # Check if this fuzzer needs ssh_server_mockCOMMENT
LOWprojects/libssh/build.sh64 # Check if this fuzzer needs ssh_client_mockCOMMENT
LOWprojects/bc-java/build.sh18# Set encoding to UTF-8 for Java compilationCOMMENT
LOWprojects/promise-polyfill/build.sh21 # Check if the file contains the "type" fieldCOMMENT
Fake / Example Data7 hits · 10 pts
SeverityFileLineSnippetContext
LOWinfra/pr_helper_test.py215 'primary_contact': 'user@example.com',CODE
LOWinfra/pr_helper_test.py219 self.assertTrue(pr_helper.is_known_contributor(content, 'user@example.com'))CODE
LOWinfra/pr_helper_test.py225 'vendor_ccs': ['user@example.com'],CODE
LOWinfra/pr_helper_test.py228 self.assertTrue(pr_helper.is_known_contributor(content, 'user@example.com'))CODE
LOWinfra/pr_helper_test.py235 'auto_ccs': ['user@example.com']CODE
LOWinfra/pr_helper_test.py237 self.assertTrue(pr_helper.is_known_contributor(content, 'user@example.com'))CODE
LOWinfra/pr_helper_test.py247 'user@example.com'))CODE
AI Response Leakage1 hit · 8 pts
SeverityFileLineSnippetContext
HIGHdocs/getting-started/new-project-guide/jvm_lang.md108# In this example, the project is built with Maven, which typically includes theCOMMENT
Example Usage Blocks4 hits · 5 pts
SeverityFileLineSnippetContext
LOWinfra/experimental/chronos/chronos.sh22# Usage:COMMENT
LOWinfra/base-images/all.sh24# Usage:COMMENT
LOWprojects/spirv-tools/generate_spirv_corpus.py26# Usage:COMMENT
LOWprojects/vlc/generate_seeds.py32# Usage:COMMENT
Modern Structural Boilerplate4 hits · 4 pts
SeverityFileLineSnippetContext
LOWinfra/helper.py108logger = logging.getLogger(__name__)CODE
LOWinfra/common_utils.py50logger = logging.getLogger(__name__)CODE
LOWinfra/chronos/manager.py30logger = logging.getLogger(__name__)CODE
LOW…/base-builder/sanitizers/pysecsan/pysecsan/__init__.py20__all__ = ['add_hooks']CODE
TODO Padding1 hit · 2 pts
SeverityFileLineSnippetContext
LOWprojects/ffmpeg/build.sh206# TODO: implement a better way to maintain a minimized seed corporaCOMMENT
AI Structural Patterns1 hit · 1 pts
SeverityFileLineSnippetContext
LOWprojects/libheif/generate_seeds.py306CODE
Overly Generic Function Names1 hit · 1 pts
SeverityFileLineSnippetContext
LOWprojects/github_scarecrow/fakelib.py19def do_something(data):CODE