OSS-Fuzz - continuous fuzzing for open source software.
This report presents the forensic synthetic code analysis of google/oss-fuzz, a Shell project with 12,426 GitHub stars. SynthScan v2.0 examined 267,670 lines of code across 4828 source files, recording 4375 pattern matches distributed across 22 syntactic categories. The overall adjusted score of 21.0 places this repository in the Moderate AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 4375 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | infra/test_repos.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | infra/repo_manager_test.py | 1 | # Copyright 2019 Google LLC | COMMENT |
| LOW | infra/pr_helper_test.py | 1 | #!/usr/bin/env python | COMMENT |
| LOW | infra/helper_test.py | 1 | # Copyright 2021 Google LLC | COMMENT |
| LOW | infra/utils_test.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | infra/manifest.py | 1 | #! /usr/bin/env python3 | COMMENT |
| LOW | infra/constants.py | 1 | # Copyright 2021 Google LLC | COMMENT |
| LOW | infra/repo_manager.py | 1 | # Copyright 2019 Google LLC | COMMENT |
| LOW | infra/build_specified_commit.py | 1 | # Copyright 2019 Google LLC | COMMENT |
| LOW | infra/retry.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | infra/templates.py | 1 | # Copyright 2016 Google Inc. | COMMENT |
| LOW | infra/templates.py | 21 | primary_contact: "<primary_contact_email>" | COMMENT |
| LOW | infra/templates.py | 61 | # | COMMENT |
| LOW | infra/templates.py | 81 | COMMENT | |
| LOW | infra/utils.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | infra/presubmit.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | infra/helper.py | 1 | #!/usr/bin/env python | COMMENT |
| LOW | infra/pr_helper.py | 1 | #!/usr/bin/env python | COMMENT |
| LOW | infra/build_specified_commit_test.py | 1 | # Copyright 2019 Google LLC | COMMENT |
| LOW | infra/bisector.py | 1 | # Copyright 2019 Google LLC | COMMENT |
| LOW | infra/common_utils.py | 1 | # Copyright 2025 Google LLC | COMMENT |
| LOW | infra/bisector_test.py | 1 | # Copyright 2019 Google LLC | COMMENT |
| LOW | infra/chronos/integrity_validator_check_replay.py | 1 | # Copyright 2025 Google LLC | COMMENT |
| LOW | infra/chronos/container_patch_replay_test.sh | 1 | #!/bin/bash -eux | COMMENT |
| LOW | infra/chronos/container_coverage_collection.sh | 1 | #!/bin/bash -eux | COMMENT |
| LOW | infra/chronos/integrity_validator_run_tests.py | 1 | # Copyright 2025 Google LLC | COMMENT |
| LOW | infra/chronos/__init__.py | 1 | #!/bin/bash -eux | COMMENT |
| LOW | infra/chronos/container_cache_build.sh | 1 | #!/bin/bash -eux | COMMENT |
| LOW | infra/chronos/coverage_test_collection.py | 1 | #!/bin/bash -eux | COMMENT |
| LOW | infra/chronos/container_patch_tests_test.sh | 1 | #!/bin/bash -eux | COMMENT |
| LOW | infra/chronos/manager.py | 1 | # Copyright 2025 Google LLC | COMMENT |
| LOW | infra/experimental/chronos/match_artifacts.sh | 1 | #!/usr/bin/bash -eux | COMMENT |
| LOW | infra/experimental/chronos/build_on_cloudbuild.sh | 1 | #!/bin/bash | COMMENT |
| LOW | infra/experimental/chronos/build_all.sh | 1 | #!/bin/bash | COMMENT |
| LOW | infra/experimental/chronos/cloudbuild_all.yaml | 1 | # Copyright 2024 Google LLC | COMMENT |
| LOW | infra/experimental/chronos/cloudbuild.yaml | 1 | # Copyright 2024 Google LLC | COMMENT |
| LOW | infra/experimental/chronos/build_cache_local.sh | 1 | #!/bin/bash -eu | COMMENT |
| LOW | infra/experimental/chronos/check_tests.sh | 1 | #!/bin/bash | COMMENT |
| LOW | infra/experimental/chronos/chronos.sh | 1 | # Copyright 2024 Google LLC | COMMENT |
| LOW | infra/experimental/chronos/e2e-replay-build.sh | 1 | #!/usr/bin/bash | COMMENT |
| LOW | infra/experimental/agent-skills/copy_to_global.sh | 1 | #!/bin/bash -eu | COMMENT |
| LOW | infra/experimental/agent-skills/helper.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | infra/experimental/mcp/config.py | 1 | # Copyright 2025 Google LLC | COMMENT |
| LOW | infra/experimental/mcp/client.py | 1 | # Copyright 2025 Google LLC | COMMENT |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 1 | # Copyright 2025 Google LLC | COMMENT |
| LOW | infra/experimental/SystemSan/SystemSan.cpp | 21 | #include <stdio.h> | COMMENT |
| LOW | …oEs/pytorch-lightning-1.5.10/fuzz_pytorch_lightning.py | 1 | #!/usr/local/bin/python3 | COMMENT |
| LOW | …ental/SystemSan/PoEs/pytorch-lightning-1.5.10/build.sh | 1 | #!/bin/bash -eu | COMMENT |
| LOW | …mental/SystemSan/PoEs/node-shell-quote-v1.7.3/build.sh | 1 | #!/bin/bash -eu | COMMENT |
| LOW | infra/tools/hold_back_images.py | 1 | #!/usr/bin/env python | COMMENT |
| LOW | infra/tools/wycheproof/run.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | infra/tools/wycheproof/package.bash | 1 | #!/bin/bash | COMMENT |
| LOW | infra/tools/wycheproof/launcher.py | 1 | #!/usr/bin/env python | COMMENT |
| LOW | infra/tools/wycheproof/generate_job.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | infra/ci/build.py | 1 | #!/usr/bin/env python | COMMENT |
| LOW | infra/ci/build_test.py | 1 | # Copyright 2020 Google LLC | COMMENT |
| LOW | infra/ci/check_base_os.py | 1 | # Copyright 2025 Google LLC | COMMENT |
| LOW | infra/base-images/list_images.py | 1 | # Copyright 2025 Google LLC | COMMENT |
| LOW | infra/base-images/all.sh | 1 | #!/bin/bash -eux | COMMENT |
| LOW | infra/base-images/all.sh | 21 | # official list of images from the Python source of truth, ensuring it never | COMMENT |
| 2941 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | infra/experimental/mcp/oss_fuzz_server.py | 40 | # Create an MCP server with a name | COMMENT |
| MEDIUM | infra/experimental/mcp/oss_fuzz_server.py | 138 | max_length = 5000 # Define a maximum length for logs | CODE |
| MEDIUM | infra/base-images/base-builder/make_build_replayable.py | 78 | # Create a shell wrapper that stubs out `configure` and `autogen`. | STRING |
| MEDIUM | …/base-images/base-builder/install_deps_ubuntu-24-04.sh | 51 | # Create a custom apt configuration to allow downgrades and non-interactive installs. | COMMENT |
| MEDIUM | …cifuzz/filestore/github_actions/github_actions_test.py | 201 | # Create a tarball. | COMMENT |
| MEDIUM | projects/jansi/build.sh | 40 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/nimbus-jwt/build.sh | 67 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/cbor-java/build.sh | 32 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/stax/build.sh | 69 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/spring-shell/build.sh | 52 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/apache-commons-cli/build.sh | 39 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/checker-framework/build.sh | 48 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/calcite/build.sh | 68 | # Create an execution wrapper for every fuzztarget | COMMENT |
| MEDIUM | projects/opt_einsum/fuzz_parser.py | 25 | # Create a numpy array with fuzzer-seeded entries. | COMMENT |
| MEDIUM | projects/hamcrest/build.sh | 41 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/apache-commons-fileupload/build.sh | 66 | # Create an execution wrapper for every fuzztarget | COMMENT |
| MEDIUM | projects/javassist/build.sh | 46 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/qdox/build.sh | 70 | # Create an execution wrapper for every fuzztarget | COMMENT |
| MEDIUM | projects/apache-commons-codec/build.sh | 38 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/graphql-java/build.sh | 61 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/json-simple/build.sh | 64 | # Create an execution wrapper for every fuzztarget | COMMENT |
| MEDIUM | projects/py-serde/fuzz_model.py | 28 | # Create an arbitrary Model structure | COMMENT |
| MEDIUM | projects/jul-to-slf4j/build.sh | 38 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/jts/build.sh | 45 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/jackson-databind/build.sh | 65 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/snakeyaml/build.sh | 40 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/spring-cloud-stream/build.sh | 55 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/netty-tcnative/build.sh | 46 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/ohc/build.sh | 42 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/presto/build.sh | 74 | # Create an execution wrapper for every fuzztarget | COMMENT |
| MEDIUM | projects/spring-data-jpa/build.sh | 42 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/jsch/build.sh | 67 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/feign/build.sh | 61 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/checkstyle/build.sh | 52 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/spring-cloud-commons/build.sh | 80 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/dom4j/build.sh | 38 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/g-auth-library-java/build.sh | 70 | # Create an execution wrapper for every fuzztarget | COMMENT |
| MEDIUM | projects/httpcomponents-core/build.sh | 40 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/async-http-client/build.sh | 70 | # Create an execution wrapper for every fuzztarget | COMMENT |
| MEDIUM | projects/pdfbox/build.sh | 69 | # Create an execution wrapper for every fuzztarget | COMMENT |
| MEDIUM | projects/gson/build.sh | 40 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/reflections/build.sh | 45 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/jooq/build.sh | 65 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/kie-soup/build.sh | 40 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/jsqlparser/build.sh | 69 | # Create an execution wrapper for every fuzztarget | COMMENT |
| MEDIUM | projects/jackson-datatype-joda/build.sh | 45 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/apache-commons-collections/build.sh | 45 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/lucene/build.sh | 45 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/open-json/build.sh | 43 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/junrar/build.sh | 42 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/univocity-parsers/build.sh | 70 | # Create an execution wrapper for every fuzztarget | COMMENT |
| MEDIUM | projects/spring-integration/build.sh | 48 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/mvel/build.sh | 66 | # Create an execution wrapper for every fuzztarget | COMMENT |
| MEDIUM | projects/antlr3-java/build.sh | 39 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/xmlunit/build.sh | 46 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/jersey/build.sh | 44 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/tomcat/build.sh | 54 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/apache-commons-math/build.sh | 40 | # Create an execution wrapper that executes Jazzer with the correct arguments. | COMMENT |
| MEDIUM | projects/apache-tika/build.sh | 53 | # Create an execution wrapper for every fuzztarget | COMMENT |
| MEDIUM | projects/closure-compiler/build.sh | 65 | # Create an execution wrapper for every fuzztarget | COMMENT |
| 188 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | projects/freeradius/generate_seeds.py | 58 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 60 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 167 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 169 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 213 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 215 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 247 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 249 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 284 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 286 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 318 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 320 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 360 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 362 | # ========================================================================== | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 908 | # ========================================================================== | COMMENT |
| MEDIUM | projects/libheif/generate_seeds.py | 49 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | projects/libheif/generate_seeds.py | 51 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | projects/libheif/generate_seeds.py | 152 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | projects/libheif/generate_seeds.py | 154 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | projects/libheif/generate_seeds.py | 214 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | projects/libheif/generate_seeds.py | 479 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | projects/ghostscript/generate_seeds.py | 49 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | projects/ghostscript/generate_seeds.py | 51 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | projects/ghostscript/generate_seeds.py | 712 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | projects/ghostscript/generate_seeds.py | 96 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 98 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 145 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 147 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 188 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 190 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 215 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 217 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 249 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 251 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 270 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 272 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 315 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 317 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 351 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 353 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 394 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 396 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 417 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 419 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 452 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 454 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 497 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 499 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 520 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/ghostscript/generate_seeds.py | 524 | # -------------------------------------------------------------------------- | STRING |
| MEDIUM | projects/binutils/generate_seeds.py | 37 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | projects/binutils/generate_seeds.py | 39 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | projects/binutils/generate_seeds.py | 259 | # ── symbol / relocation helpers ────────────────────────────────────── | COMMENT |
| MEDIUM | projects/binutils/generate_seeds.py | 289 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | projects/binutils/generate_seeds.py | 291 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | projects/binutils/generate_seeds.py | 342 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | projects/binutils/generate_seeds.py | 344 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | projects/binutils/generate_seeds.py | 632 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | projects/binutils/generate_seeds.py | 634 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | projects/binutils/generate_seeds.py | 750 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| 82 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | infra/helper.py | 20 | CODE | |
| LOW | infra/helper.py | 28 | CODE | |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 41 | CODE | |
| LOW | infra/ci/build.py | 19 | CODE | |
| LOW | …/base-builder/sanitizers/pysecsan/pysecsan/__init__.py | 17 | CODE | |
| LOW | infra/cifuzz/fuzz_target_test.py | 26 | CODE | |
| LOW | infra/cifuzz/filestore/gsutil/__init__.py | 18 | CODE | |
| LOW | infra/cifuzz/filestore/gitlab/__init__.py | 17 | CODE | |
| LOW | infra/cifuzz/filestore/gitlab/__init__.py | 20 | CODE | |
| LOW | infra/cifuzz/filestore/gitlab/__init__.py | 23 | CODE | |
| LOW | infra/cifuzz/filestore/filesystem/__init__.py | 15 | CODE | |
| LOW | infra/cifuzz/filestore/filesystem/__init__.py | 17 | CODE | |
| LOW | infra/cifuzz/filestore/filesystem/__init__.py | 18 | CODE | |
| LOW | projects/psqlparse/fuzz_parse.py | 20 | CODE | |
| LOW | projects/psqlparse/fuzz_parse.py | 26 | CODE | |
| LOW | projects/flask/cors_fuzz_flask.py | 19 | CODE | |
| LOW | projects/mdit-py-plugins/fuzz_containers.py | 20 | CODE | |
| LOW | projects/mdit-py-plugins/fuzz_plugins_individually.py | 20 | CODE | |
| LOW | projects/keras/fuzz_model.py | 17 | CODE | |
| LOW | projects/keras/fuzz_model.py | 18 | CODE | |
| LOW | projects/keras/fuzz_model.py | 19 | CODE | |
| LOW | projects/keras/fuzz_serialization.py | 19 | CODE | |
| LOW | projects/aiohttp/fuzz_http_parser.py | 32 | CODE | |
| LOW | projects/aiohttp/fuzz_http_payload_parser.py | 31 | CODE | |
| LOW | projects/aiohttp/fuzz_payload_url.py | 21 | CODE | |
| LOW | projects/aiohttp/fuzz_web_request.py | 16 | CODE | |
| LOW | projects/aiohttp/fuzz_web_request.py | 23 | CODE | |
| LOW | projects/pyasn1/fuzz_decode.py | 16 | CODE | |
| LOW | projects/pem/fuzz_pem.py | 16 | CODE | |
| LOW | projects/py-serde/fuzz_model.py | 16 | CODE | |
| LOW | projects/ffmpeg/group_seed_corpus.py | 18 | CODE | |
| LOW | projects/pymysql/fuzz_connection.py | 24 | CODE | |
| LOW | projects/toolz/fuzz_itertoolz.py | 18 | CODE | |
| LOW | projects/toolz/fuzz_itertoolz.py | 18 | CODE | |
| LOW | projects/toolz/fuzz_itertoolz.py | 18 | CODE | |
| LOW | projects/gpowerd/translate_protos.py | 19 | CODE | |
| LOW | projects/defusedxml/fuzz_etree_parse.py | 20 | CODE | |
| LOW | projects/defusedxml/fuzz_parse_string.py | 22 | CODE | |
| LOW | projects/attrs/fuzz_attrs.py | 22 | CODE | |
| LOW | projects/pyrsistent/fuzz_vector.py | 16 | CODE | |
| LOW | projects/oauthlib/fuzz_oauth1_sig.py | 16 | CODE | |
| LOW | projects/pygments/fuzz_lexers.py | 21 | CODE | |
| LOW | projects/mako/fuzz_lexer.py | 15 | CODE | |
| LOW | projects/retry/fuzz_retry.py | 19 | CODE | |
| LOW | projects/decorator/fuzz_decorator.py | 18 | CODE | |
| LOW | projects/decorator/fuzz_decorator.py | 20 | CODE | |
| LOW | projects/decorator/fuzz_funcmarker.py | 18 | CODE | |
| LOW | projects/decorator/fuzz_funcmarker.py | 20 | CODE | |
| LOW | projects/dask/fuzz_fuse.py | 18 | CODE | |
| LOW | projects/g-api-py-oauthlib/fuzz_config.py | 16 | CODE | |
| LOW | projects/docutils/fuzz_rst.py | 24 | CODE | |
| LOW | projects/docutils/fuzz_rst.py | 25 | CODE | |
| LOW | projects/docutils/fuzz_rst.py | 25 | CODE | |
| LOW | projects/abseil-py/fuzz_argparse.py | 22 | CODE | |
| LOW | projects/et-xmlfile/fuzz_write.py | 16 | CODE | |
| LOW | projects/et-xmlfile/fuzz_write.py | 22 | CODE | |
| LOW | projects/pyparsing/fuzz_parse.py | 16 | CODE | |
| LOW | projects/angle/gen_clones.py | 17 | CODE | |
| LOW | projects/grpc-py/fuzz_server.py | 21 | CODE | |
| LOW | projects/grpc-py/fuzz_server.py | 27 | CODE | |
| 290 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | infra/repo_manager_test.py | 45 | def test_clone_valid_repo_integration(self): | CODE |
| LOW | infra/repo_manager_test.py | 79 | def test_checkout_valid_commit(self): | CODE |
| LOW | infra/repo_manager_test.py | 87 | def test_checkout_invalid_commit(self): | CODE |
| LOW | infra/repo_manager_test.py | 104 | def test_get_valid_commit_list(self): | CODE |
| LOW | infra/repo_manager_test.py | 119 | def test_get_invalid_commit_list(self): | CODE |
| LOW | infra/repo_manager_test.py | 188 | def test_checkout_invalid_pull_request(self): | CODE |
| LOW⚡ | infra/pr_helper_test.py | 97 | def test_save_env_newline_injection_blocked(self): | CODE |
| LOW⚡ | infra/pr_helper_test.py | 105 | def test_save_env_carriage_return_injection_blocked(self): | CODE |
| LOW⚡ | infra/pr_helper_test.py | 112 | def test_save_env_injection_via_all_fields(self): | CODE |
| LOW⚡ | infra/pr_helper_test.py | 120 | def test_save_env_none_values(self, mock_uuid): | CODE |
| LOW⚡ | infra/pr_helper_test.py | 129 | def test_save_env_full_attack_scenario(self): | CODE |
| LOW | infra/pr_helper_test.py | 165 | def test_url_with_newline_injection(self): | CODE |
| LOW | infra/pr_helper_test.py | 172 | def test_url_with_carriage_return(self): | CODE |
| LOW | infra/pr_helper_test.py | 195 | def test_invalid_scheme_rejected(self): | CODE |
| LOW | infra/pr_helper_test.py | 201 | def test_ssh_url_with_newline_injection(self): | CODE |
| LOW⚡ | infra/pr_helper_test.py | 212 | def test_primary_contact_match(self): | CODE |
| LOW | infra/helper_test.py | 139 | def test_generate_oss_fuzz_project(self, _): | CODE |
| LOW | infra/helper_test.py | 148 | def test_generate_external_project(self): | CODE |
| LOW | infra/helper_test.py | 161 | def test_generate_swift_project(self, _): | CODE |
| LOW⚡ | infra/helper_test.py | 181 | def test_init_external_project(self): | CODE |
| LOW⚡ | infra/helper_test.py | 190 | def test_init_internal_project(self): | CODE |
| LOW⚡ | infra/helper_test.py | 197 | def test_dockerfile_path_internal_project(self): | CODE |
| LOW⚡ | infra/helper_test.py | 204 | def test_dockerfile_path_external_project(self): | CODE |
| LOW | infra/helper_test.py | 236 | def test_language_internal_project(self): | CODE |
| LOW | infra/helper_test.py | 242 | def test_language_external_project(self): | CODE |
| LOW | infra/repo_manager.py | 235 | def clone_repo_and_get_manager(repo_url, | CODE |
| LOW | infra/build_specified_commit.py | 104 | def _replace_base_builder_digest(dockerfile_path, digest): | CODE |
| LOW | infra/build_specified_commit.py | 147 | def _build_image_with_retries(project_name): | CODE |
| LOW | infra/build_specified_commit.py | 152 | def get_required_post_checkout_steps(dockerfile_path): | CODE |
| LOW | infra/build_specified_commit.py | 180 | def build_fuzzers_from_commit(commit, | CODE |
| LOW | infra/presubmit.py | 50 | def _check_one_lib_fuzzing_engine(build_sh_file): | CODE |
| LOW | infra/presubmit.py | 157 | def check_project_yaml_constants(self): | CODE |
| LOW | infra/presubmit.py | 179 | def check_valid_section_names(self): | CODE |
| LOW | infra/helper.py | 210 | def _add_external_project_args(parser): | CODE |
| LOW | infra/helper.py | 939 | def _add_oss_fuzz_ci_if_needed(env): | CODE |
| LOW | infra/helper.py | 1051 | def _get_latest_public_corpus(args, fuzzer): | CODE |
| LOW | infra/helper.py | 1129 | def _download_for_single_target(fuzz_target): | CODE |
| LOW | infra/helper.py | 1222 | def _introspector_prepare_corpus(args): | CODE |
| LOW | infra/helper.py | 1556 | def _create_build_integration_directory(directory): | CODE |
| LOW | infra/helper.py | 1591 | def _base_builder_from_language(language): | CODE |
| LOW | infra/pr_helper.py | 235 | def get_integrated_project_info(self): | CODE |
| LOW | infra/pr_helper.py | 304 | def is_author_internal_member(self): | CODE |
| LOW | infra/pr_helper.py | 308 | def has_author_modified_project(self, project_path): | CODE |
| LOW | infra/build_specified_commit_test.py | 39 | def test_build_fuzzers_from_commit(self): | CODE |
| LOW | infra/build_specified_commit_test.py | 81 | def test_detect_main_repo_from_commit(self): | CODE |
| LOW | infra/build_specified_commit_test.py | 101 | def test_detect_main_repo_from_name(self): | CODE |
| LOW | infra/chronos/integrity_validator_check_replay.py | 51 | def source_code_compile_error(): | CODE |
| LOW | infra/chronos/integrity_validator_run_tests.py | 36 | def _add_payload_random_functions(exts: list[str], payload: str) -> str: | CODE |
| LOW | infra/chronos/coverage_test_collection.py | 26 | def collect_coverage_profraw_files(): | CODE |
| LOW⚡ | infra/chronos/manager.py | 39 | def _get_project_cached_named(project: common_utils.Project, | CODE |
| LOW⚡ | infra/chronos/manager.py | 46 | def _get_project_cached_named_local(project: common_utils.Project, | CODE |
| LOW⚡ | infra/chronos/manager.py | 422 | def cmd_dispatcher_check_tests(args): | CODE |
| LOW⚡ | infra/chronos/manager.py | 430 | def cmd_dispatcher_check_replay(args): | CODE |
| LOW⚡ | infra/chronos/manager.py | 437 | def cmd_dispatcher_build_cached_image(args): | CODE |
| LOW⚡ | infra/chronos/manager.py | 442 | def cmd_dispatcher_extract_coverage(args): | CODE |
| LOW | infra/experimental/agent-skills/helper.py | 822 | def cleanup_project_artifacts(project): | STRING |
| LOW | infra/experimental/agent-skills/helper.py | 921 | def _run_single_integrate_session(agent_cli, project_url): | CODE |
| LOW | infra/experimental/agent-skills/helper.py | 1136 | def build_consolidation_prompt(project): | CODE |
| LOW | infra/experimental/agent-skills/helper.py | 1149 | def launch_consolidation_session(agent_cli, project): | CODE |
| LOW | infra/experimental/agent-skills/helper.py | 1188 | def _run_single_consolidation_session(agent_cli, project): | CODE |
| 220 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | infra/templates.py | 44 | RUN apt-get update && apt-get install -y make autoconf automake libtool | CODE |
| HIGH | infra/templates.py | 52 | RUN apt-get update && apt-get install -y make autoconf automake libtool | CODE |
| HIGH | infra/chronos/manager.py | 176 | base_cmd = 'export PATH=/ccache/bin:$PATH && rm -rf /out/* && compile' | CODE |
| HIGH | infra/experimental/agent-skills/helper.py | 983 | print(f' cd {OSS_FUZZ_ROOT} && git diff && git status') | CODE |
| HIGH⚡ | infra/experimental/mcp/client.py | 659 | cd $GOPATH/src/$path || true | CODE |
| HIGH⚡ | infra/experimental/mcp/client.py | 661 | go mod tidy || true | CODE |
| HIGH⚡ | infra/experimental/mcp/client.py | 665 | go list $tags $path || { go mod init $path && go mod tidy ;} | CODE |
| HIGH | infra/experimental/mcp/client.py | 679 | abspath_repo=`go list -m $tags -f {{.Dir}} $fuzzed_repo || go list $tags -f {{.Dir}} $fuzzed_repo` | CODE |
| HIGH | infra/experimental/mcp/client.py | 688 | abspath_repo=`go list -m $tags -f {{.Dir}} $GO_COV_ADD_PKG || go list $tags -f {{.Dir}} $GO_COV_ADD_PKG` | CODE |
| HIGH | infra/experimental/mcp/client.py | 850 | RUN apt-get update && apt-get install -y make autoconf automake libtool | CODE |
| HIGH⚡ | infra/experimental/contrib/arvo/arvo_reproducer.py | 641 | f"git reset --hard $commit || exit 99) ; " | CODE |
| HIGH⚡ | infra/experimental/contrib/arvo/arvo_reproducer.py | 642 | f"(git submodule init && git submodule update --force) ;popd'") | CODE |
| HIGH⚡ | infra/experimental/contrib/arvo/arvo_reproducer.py | 649 | f"git reset --hard $commit || exit 99) ; " | CODE |
| HIGH⚡ | infra/experimental/contrib/arvo/arvo_reproducer.py | 650 | f"(git submodule init && git submodule update --force) ;popd'") | CODE |
| HIGH | infra/experimental/contrib/arvo/arvo_data.py | 73 | r'RUN apt', "RUN apt update -y && apt install git ca-certificates -y && " | CODE |
| HIGH | infra/experimental/contrib/arvo/hacks/imagemagick.py | 14 | "RUN mkdir /src/heic_corpus && touch /src/heic_corpus/XxX") | CODE |
| HIGH | infra/experimental/contrib/arvo/hacks/libreoffice.py | 42 | line, 'echo "pushd instdir/program && mv *fuzzer $OUT" >> ' | CODE |
| HIGH⚡ | infra/cifuzz/continuous_integration_test.py | 66 | 'cp -r /path/on/host/to/repo /src && cd - ' | CODE |
| HIGH | projects/freeradius/generate_seeds.py | 470 | " if ((1 + 2) > 2 || 0) { ok }\n" | CODE |
| HIGH | projects/freeradius/generate_seeds.py | 711 | b'{"a":1,"b":2.5,"c":true,"d":null,"e":false}', | CODE |
| HIGH | projects/freeradius/generate_seeds.py | 713 | b'[1,2,3,4,5,"six",7.0,8e3,-9,true,false,null]', | CODE |
| HIGH | projects/yyjson/generate_patch_corpora.py | 126 | "{\"op\":\"add\",\"path\":null,\"value\":2}]"), | CODE |
| HIGH⚡ | projects/yyjson/generate_patch_corpora.py | 203 | ("{\"a\":\"b\"}", "{\"a\":null }"), | CODE |
| HIGH⚡ | projects/yyjson/generate_patch_corpora.py | 204 | ("{\"a\":\"b\"}", "{\"a\":null }"), | CODE |
| HIGH⚡ | projects/yyjson/generate_patch_corpora.py | 205 | ("{\"a\":\"b\", \"b\":\"c\"}", "{\"a\":null }"), | CODE |
| HIGH⚡ | projects/yyjson/generate_patch_corpora.py | 208 | ("{\"a\":{\"b\":\"c\"}}", "{\"a\":{\"b\":\"d\",\"c\":null}}"), | CODE |
| HIGH⚡ | projects/yyjson/generate_patch_corpora.py | 214 | ("{\"e\":null}", "{\"a\":1}"), | CODE |
| HIGH⚡ | projects/yyjson/generate_patch_corpora.py | 215 | ("[1,2]", "{\"a\":\"b\",\"c\":null}"), | CODE |
| HIGH⚡ | projects/yyjson/generate_patch_corpora.py | 216 | ("{}", "{\"a\":{\"bb\":{\"ccc\":null}}}"), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | infra/cifuzz/clusterfuzz_deployment_test.py | 0 | creates a config object from |config_cls| and then sets every attribute that is a key in |kwargs| to the corresponding v | STRING |
| HIGH | infra/cifuzz/fuzz_target_test.py | 0 | creates a config object from |config_cls| and then sets every attribute that is a key in |kwargs| to the corresponding v | STRING |
| HIGH | infra/cifuzz/test_helpers.py | 0 | creates a config object from |config_cls| and then sets every attribute that is a key in |kwargs| to the corresponding v | STRING |
| HIGH | infra/cifuzz/filestore/__init__.py | 0 | uploads the coverage report at |directory| to |name|. | STRING |
| HIGH | infra/cifuzz/filestore/gsutil/__init__.py | 0 | uploads the coverage report at |directory| to |name|. | STRING |
| HIGH | infra/cifuzz/filestore/filesystem/__init__.py | 0 | uploads the coverage report at |directory| to |name|. | STRING |
| HIGH | infra/cifuzz/filestore/github_actions/__init__.py | 0 | uploads the coverage report at |directory| to |name|. | STRING |
| HIGH | infra/cifuzz/filestore/git/__init__.py | 0 | uploads the coverage report at |directory| to |name|. | STRING |
| HIGH | infra/cifuzz/filestore/__init__.py | 0 | downloads the corpus located at |name| to |dst_directory|. | STRING |
| HIGH | infra/cifuzz/filestore/gsutil/__init__.py | 0 | downloads the corpus located at |name| to |dst_directory|. | STRING |
| HIGH | infra/cifuzz/filestore/filesystem/__init__.py | 0 | downloads the corpus located at |name| to |dst_directory|. | STRING |
| HIGH | infra/cifuzz/filestore/github_actions/__init__.py | 0 | downloads the corpus located at |name| to |dst_directory|. | STRING |
| HIGH | infra/cifuzz/filestore/git/__init__.py | 0 | downloads the corpus located at |name| to |dst_directory|. | STRING |
| HIGH | infra/cifuzz/filestore/__init__.py | 0 | downloads the build with name |name| to |dst_directory|. | STRING |
| HIGH | infra/cifuzz/filestore/gsutil/__init__.py | 0 | downloads the build with name |name| to |dst_directory|. | STRING |
| HIGH | infra/cifuzz/filestore/filesystem/__init__.py | 0 | downloads the build with name |name| to |dst_directory|. | STRING |
| HIGH | infra/cifuzz/filestore/git/__init__.py | 0 | downloads the build with name |name| to |dst_directory|. | STRING |
| HIGH | infra/cifuzz/filestore/github_actions/__init__.py | 0 | downloads the build with name |name| to |dst_directory|. | STRING |
| HIGH | infra/cifuzz/platform_config/standalone.py | 0 | returns the filestore used to store persistent data. | STRING |
| HIGH | infra/cifuzz/platform_config/gitlab.py | 0 | returns the filestore used to store persistent data. | STRING |
| HIGH | infra/cifuzz/platform_config/__init__.py | 0 | returns the filestore used to store persistent data. | STRING |
| HIGH | infra/cifuzz/platform_config/gcb.py | 0 | returns the filestore used to store persistent data. | STRING |
| HIGH | infra/cifuzz/platform_config/prow.py | 0 | returns the filestore used to store persistent data. | STRING |
| HIGH | infra/cifuzz/platform_config/__init__.py | 0 | returns the base commit to diff against (commit fuzzing). | STRING |
| HIGH | infra/cifuzz/platform_config/prow.py | 0 | returns the base commit to diff against (commit fuzzing). | STRING |
| HIGH | infra/cifuzz/platform_config/github.py | 0 | returns the base commit to diff against (commit fuzzing). | STRING |
| HIGH | infra/cifuzz/platform_config/__init__.py | 0 | returns the base branch to diff against (pr fuzzing). | STRING |
| HIGH | infra/cifuzz/platform_config/prow.py | 0 | returns the base branch to diff against (pr fuzzing). | STRING |
| HIGH | infra/cifuzz/platform_config/github.py | 0 | returns the base branch to diff against (pr fuzzing). | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | infra/experimental/agent-skills/helper.py | 1695 | # Single focused harness per project (no summary by default): | COMMENT |
| MEDIUM | infra/experimental/mcp/client.py | 117 | # Build fuzz harness. | COMMENT |
| LOW | …es/base-builder/sanitizers/pysecsan/pysecsan/sanlib.py | 155 | # Otherwise, just return attribute of instance | COMMENT |
| MEDIUM | infra/cifuzz/build_fuzzers.py | 14 | """Module used by CI tools in order to interact with fuzzers. This module helps | STRING |
| MEDIUM | projects/freeradius/generate_seeds.py | 827 | # inside the harness, so emit each string under a spread of selector bytes. | COMMENT |
| MEDIUM | projects/freeradius/generate_seeds.py | 920 | except Exception as e: # keep build robust | CODE |
| MEDIUM | projects/wolfssh/build.sh | 56 | # Build the fuzzer harness | COMMENT |
| MEDIUM | projects/libheif/generate_seeds.py | 514 | except Exception as e: # keep build robust | CODE |
| MEDIUM | projects/connectedhomeip/build.sh | 123 | # The FuzzChipCert harness seeds from a source-tree directory that is not present in the | COMMENT |
| MEDIUM | projects/connectedhomeip/build.sh | 126 | # target -- so libFuzzer uses them as the initial corpus. (The harness itself tolerates the | COMMENT |
| MEDIUM | projects/postcss/build.sh | 36 | # Build Fuzzers. The harness lives upstream at test/fuzzing/fuzz_parse.js | COMMENT |
| MEDIUM | projects/libpg_query/build.sh | 22 | # Protobuf parse + deparse + fingerprint/normalize/scan harness | COMMENT |
| MEDIUM | projects/libpg_query/build.sh | 26 | # PL/pgSQL function-body parser harness (separate grammar/scanner) | COMMENT |
| MEDIUM | projects/tdengine/build.sh | 51 | # Compile the fuzzer harness | COMMENT |
| MEDIUM | projects/libiec61850/build.sh | 26 | # Build every harness in the upstream fuzz/ directory. | COMMENT |
| MEDIUM | projects/vlc/build.sh | 198 | # libFuzzer's ParseDictionaryFile rejects such lines, breaking the generic harness. | COMMENT |
| MEDIUM | projects/vlc/build.sh | 219 | # Write an options file to disable leak for the general harness | COMMENT |
| MEDIUM⚡ | projects/vlc/generate_seeds.py | 1706 | # registered in the fuzz harness, so codec/telx.c is entirely absent from the | COMMENT |
| MEDIUM⚡ | projects/vlc/generate_seeds.py | 4352 | # the H.264/H.265 packetizers — the test harness discards packetizer pf_get_cc | COMMENT |
| MEDIUM⚡ | projects/vlc/generate_seeds.py | 4599 | # The harness forces the "mod" demuxer by name, so demux->obj.force is true and | COMMENT |
| MEDIUM | projects/vlc/generate_seeds.py | 2667 | # The libfuzzer harness picks the demuxer module from the binary-name | COMMENT |
| MEDIUM | projects/vlc/generate_seeds.py | 2709 | # Round 2 — comprehensive event stream. The previous seeds covered only a | COMMENT |
| MEDIUM | projects/vlc/generate_seeds.py | 4790 | # never registered in the harness (absent from coverage). A structurally | COMMENT |
| MEDIUM | projects/dcmtk/build.sh | 49 | # Derive robust link set from pkg-config and filter to installed libs. | COMMENT |
| MEDIUM | projects/qemu/replay_build.sh | 68 | # Skip generic harness. | COMMENT |
| MEDIUM | projects/rapidjson/build.sh | 30 | # Build fuzz harness. | COMMENT |
| MEDIUM⚡ | projects/duckdb/build.sh | 19 | # json_extract), which the csv_json harness exercises; parquet is built by | COMMENT |
| MEDIUM⚡ | projects/duckdb/build.sh | 25 | # Patch the csv_json harness to force-load the statically-linked json extension. | COMMENT |
| MEDIUM⚡ | projects/duckdb/build.sh | 27 | # The upstream harness (test/ossfuzz/csv_json_fuzz_test.cpp) exercises the json | COMMENT |
| MEDIUM⚡ | projects/duckdb/build.sh | 37 | # harness upstream (duckdb/duckdb test/ossfuzz/csv_json_fuzz_test.cpp). | COMMENT |
| MEDIUM⚡ | projects/duckdb/build.sh | 44 | # harness whose JSON cases are dead. | COMMENT |
| MEDIUM⚡ | projects/duckdb/build.sh | 50 | # Build each OSS-Fuzz harness in test/ossfuzz/ against the statically-linked | COMMENT |
| MEDIUM | projects/gstreamer/generate_seeds.py | 92 | # A few profile/tier/level variants. (Empirically the harness's h264/h265 | COMMENT |
| MEDIUM | projects/gstreamer/generate_seeds.py | 114 | # --- Opus header tail (harness prepends "OpusHead\x01"). | COMMENT |
| MEDIUM | projects/gstreamer/generate_seeds.py | 355 | # comprehensive multi-IFD EXIF (main + Exif sub-IFD + GPS sub-IFD): hits | COMMENT |
| MEDIUM | projects/ipmi-fru-parser/build.sh | 80 | # Compile fuzz harness | COMMENT |
| MEDIUM | projects/wolftpm/build.sh | 52 | # Build the fuzz harness, linking wolftpm + wolfssl statically. | COMMENT |
| LOW | projects/esp-v2/build.sh | 141 | # TODO(nareddyt): just use the .tar directly when | COMMENT |
| MEDIUM | projects/imagemagick/run_tests.sh | 22 | # interface for comprehensive testing of ImageMagick. | COMMENT |
| MEDIUM | projects/nsmd/build.sh | 36 | # Compile and link each C++ fuzzer harness into a separate executable | COMMENT |
| MEDIUM | projects/wolfboot/build.sh | 55 | # Fold the two extra parser objects into libwolfboot.a so the harness | COMMENT |
| MEDIUM | projects/wolfboot/build.sh | 59 | # Harness compile/link. Each harness builds against the parser interface | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …ects/jackson-datatype-joda/JodaDeserializerFuzzer.java | 53 | mapper = tools.jackson.databind.json.JsonMapper.builder() | CODE |
| CRITICAL | …ojects/jackson-datatype-joda/JodaSerializerFuzzer.java | 39 | mapper = tools.jackson.databind.json.JsonMapper.builder() | CODE |
| CRITICAL | …ojects/jackson-datatype-joda/JodaSerializerFuzzer.java | 49 | mapper = tools.jackson.databind.json.JsonMapper.builder() | CODE |
| CRITICAL | …/org/apache/struts/test/StrutsSimpleRequestFuzzer.java | 41 | com.code_intelligence.jazzer.api.BugDetectors.allowNetworkConnections(); | CODE |
| CRITICAL | …rc/main/java/ossfuzz/ConfigServerPropertiesFuzzer.java | 33 | ConfigServerProperties config = new org.springframework.cloud.config.server.config.ConfigServerProperties(); | CODE |
| CRITICAL | projects/powsybl-java/ParseFuzzer.java | 176 | "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\"" | CODE |
| CRITICAL | projects/powsybl-java/DeserializeFuzzer.java | 295 | "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\"" | CODE |
| CRITICAL | projects/powsybl-java/MetrixFuzzer.java | 300 | "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\"" | CODE |
| CRITICAL | projects/powsybl-java/LoadFlowFuzzer.java | 252 | "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\"" | CODE |
| CRITICAL | projects/powsybl-java/OpenRaoFuzzer.java | 142 | "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\"" | CODE |
| CRITICAL | projects/swagger-core/YamlFuzzer.java | 26 | io.swagger.v3.core.util.Yaml31.jsonSchemaAsMap(data.consumeRemainingAsString()); | CODE |
| CRITICAL | …nit-fuzzer/src/main/java/ossfuzz/HtmlParserFuzzer.java | 48 | com.code_intelligence.jazzer.api.BugDetectors.allowNetworkConnections(); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | infra/retry.py | 36 | CODE | |
| LOW | infra/retry.py | 47 | CODE | |
| LOW | infra/retry.py | 70 | CODE | |
| LOW | infra/retry.py | 86 | CODE | |
| LOW | infra/presubmit.py | 157 | CODE | |
| LOW | infra/helper.py | 116 | CODE | |
| LOW | infra/pr_helper.py | 95 | CODE | |
| LOW | infra/bisector.py | 177 | CODE | |
| LOW | infra/common_utils.py | 227 | CODE | |
| LOW | infra/chronos/integrity_validator_check_replay.py | 30 | CODE | |
| LOW | infra/chronos/integrity_validator_check_replay.py | 51 | CODE | |
| LOW | infra/chronos/integrity_validator_check_replay.py | 69 | CODE | |
| LOW | infra/chronos/integrity_validator_check_replay.py | 87 | CODE | |
| LOW | infra/chronos/integrity_validator_check_replay.py | 124 | CODE | |
| LOW | infra/chronos/integrity_validator_check_replay.py | 178 | CODE | |
| LOW | infra/chronos/integrity_validator_run_tests.py | 36 | CODE | |
| LOW | infra/chronos/integrity_validator_run_tests.py | 116 | CODE | |
| LOW | infra/chronos/integrity_validator_run_tests.py | 221 | CODE | |
| LOW | infra/chronos/coverage_test_collection.py | 38 | CODE | |
| LOW | infra/chronos/manager.py | 193 | CODE | |
| LOW | infra/experimental/agent-skills/helper.py | 986 | CODE | |
| LOW | infra/experimental/agent-skills/helper.py | 1530 | CODE | |
| LOW | infra/experimental/mcp/client.py | 422 | CODE | |
| LOW | infra/experimental/mcp/client.py | 946 | CODE | |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 186 | CODE | |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 544 | CODE | |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 192 | CODE | |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 575 | CODE | |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 768 | CODE | |
| LOW | infra/experimental/contrib/arvo/arvo_utils.py | 176 | CODE | |
| LOW | infra/experimental/contrib/arvo/arvo_utils.py | 612 | CODE | |
| LOW | infra/ci/check_base_os.py | 43 | CODE | |
| LOW | …base-images/base-runner/python_coverage_runner_help.py | 83 | CODE | |
| LOW | infra/base-images/base-runner/test_all.py | 70 | CODE | |
| LOW | …fra/base-images/base-builder/python_coverage_helper.py | 25 | CODE | |
| LOW | infra/base-images/base-builder/unshallow_repos.py | 25 | CODE | |
| LOW | infra/base-images/base-builder/detect_repo.py | 74 | CODE | |
| LOW | …lder/sanitizers/pysecsan/pysecsan/command_injection.py | 36 | CODE | |
| LOW | …fra/base-images/base-builder/indexer/manifest_types.py | 399 | CODE | |
| LOW | infra/base-images/base-builder/indexer/dwarf_info.py | 50 | CODE | |
| LOW | infra/base-images/base-builder/indexer/clang_wrapper.py | 322 | CODE | |
| LOW | …a/base-images/base-builder/indexer/index_build_test.py | 79 | CODE | |
| LOW | infra/base-images/base-builder/indexer/index_build.py | 164 | CODE | |
| LOW | infra/base-images/base-builder/indexer/index_build.py | 312 | CODE | |
| LOW | infra/base-images/base-builder/indexer/index_build.py | 729 | CODE | |
| LOW | infra/cifuzz/fuzz_target.py | 167 | CODE | |
| LOW | infra/cifuzz/config_utils.py | 241 | CODE | |
| LOW | infra/cifuzz/config_utils.py | 203 | CODE | |
| LOW | infra/cifuzz/config_utils.py | 335 | CODE | |
| LOW | projects/paramiko/fuzz_packetizer.py | 39 | CODE | |
| LOW | projects/libheif/generate_seeds.py | 306 | CODE | |
| LOW | projects/ffmpeg/group_seed_corpus.py | 30 | CODE | |
| LOW | projects/ffmpeg/group_seed_corpus.py | 90 | CODE | |
| LOW | projects/pyrsistent/fuzz_vector.py | 23 | CODE | |
| LOW | projects/pyparsing/fuzz_parse.py | 30 | CODE | |
| LOW | projects/angle/gen_clones.py | 20 | CODE | |
| LOW | projects/vlc/generate_seeds.py | 4782 | CODE | |
| LOW | projects/vlc/generate_seeds.py | 5276 | CODE | |
| LOW | projects/vlc/generate_seeds.py | 4839 | CODE | |
| LOW | projects/vlc/generate_seeds.py | 4937 | CODE | |
| 20 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | infra/retry.py | 81 | except Exception as error: | CODE |
| LOW | infra/retry.py | 98 | except Exception as error: | CODE |
| MEDIUM | infra/presubmit.py | 62 | print('Error: build.sh contains deprecated "-lFuzzingEngine" on line: ' | CODE |
| MEDIUM | infra/presubmit.py | 145 | print(f'Error in {self.filename}: {message}') | CODE |
| LOW | infra/helper.py | 1136 | except Exception as error: # pylint:disable=broad-except | CODE |
| MEDIUM | infra/helper.py | 1129 | def _download_for_single_target(fuzz_target): | CODE |
| MEDIUM | infra/bisector.py | 119 | print('Error was introduced at commit %s' % result.commit) | CODE |
| MEDIUM | infra/bisector.py | 121 | print('Error was fixed at commit %s' % result.commit) | CODE |
| LOW | infra/chronos/integrity_validator_check_replay.py | 47 | except Exception: | CODE |
| LOW | infra/chronos/integrity_validator_check_replay.py | 65 | except Exception: | CODE |
| LOW | infra/chronos/integrity_validator_check_replay.py | 83 | except Exception: | CODE |
| LOW | infra/chronos/integrity_validator_check_replay.py | 120 | except Exception: | CODE |
| LOW | infra/chronos/integrity_validator_check_replay.py | 154 | except Exception: | CODE |
| LOW | infra/chronos/integrity_validator_check_replay.py | 174 | except Exception: | CODE |
| LOW | infra/chronos/integrity_validator_check_replay.py | 209 | except Exception: | CODE |
| LOW | infra/chronos/integrity_validator_run_tests.py | 59 | except Exception: | CODE |
| LOW | infra/chronos/integrity_validator_run_tests.py | 89 | except Exception: | CODE |
| LOW | infra/chronos/integrity_validator_run_tests.py | 143 | except Exception: | CODE |
| LOW | infra/chronos/integrity_validator_run_tests.py | 180 | except Exception: | CODE |
| LOW | infra/experimental/mcp/client.py | 206 | except Exception as e: | STRING |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 378 | except Exception as e: | CODE |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 404 | except Exception as e: | CODE |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 435 | except Exception as e: | CODE |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 451 | except Exception as e: | CODE |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 478 | except Exception as e: | CODE |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 506 | except Exception as e: | CODE |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 185 | except Exception: | CODE |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 1045 | except Exception: | CODE |
| MEDIUM | infra/ci/check_base_os.py | 74 | print(f'Error: Dockerfile not found at {dockerfile_path}', file=sys.stderr) | CODE |
| MEDIUM | infra/ci/check_base_os.py | 89 | print(f'Error: Could not parse tag from Dockerfile FROM line: {line}', | CODE |
| LOW | …r/sanitizers/pysecsan/pysecsan/yaml_deserialization.py | 23 | except Exception: | CODE |
| LOW | …fra/base-images/base-builder/indexer/manifest_types.py | 539 | except Exception as e: # pylint: disable=broad-except | CODE |
| LOW | infra/base-images/base-builder/indexer/index_build.py | 714 | except Exception: # pylint: disable=broad-exception-caught | CODE |
| LOW | infra/cifuzz/clusterfuzz_deployment.py | 136 | except Exception as err: # pylint: disable=broad-except | CODE |
| LOW | infra/cifuzz/clusterfuzz_deployment.py | 150 | except Exception as err: # pylint: disable=broad-except | CODE |
| LOW | infra/cifuzz/clusterfuzz_deployment.py | 169 | except Exception as err: # pylint: disable=broad-except | CODE |
| LOW | infra/cifuzz/clusterfuzz_deployment.py | 181 | except Exception as err: # pylint: disable=broad-except | CODE |
| LOW | infra/cifuzz/clusterfuzz_deployment.py | 203 | except Exception as err: # pylint: disable=broad-except | CODE |
| LOW | infra/cifuzz/clusterfuzz_deployment.py | 221 | except Exception as err: # pylint: disable=broad-except | CODE |
| LOW | infra/cifuzz/http_utils.py | 72 | except Exception: # pylint: disable=broad-except | CODE |
| LOW | infra/cifuzz/config_utils.py | 232 | except Exception: # pylint: disable=broad-except | CODE |
| LOW | projects/freeradius/generate_seeds.py | 920 | except Exception as e: # keep build robust | CODE |
| LOW | projects/flask/cors_fuzz_flask.py | 78 | except Exception: | CODE |
| LOW | projects/flask/cors_fuzz_flask.py | 89 | except Exception as e: | CODE |
| LOW | projects/aiohttp/fuzz_web_request.py | 34 | except Exception: | CODE |
| LOW | projects/libheif/generate_seeds.py | 514 | except Exception as e: # keep build robust | CODE |
| LOW | projects/ujson/json_differential_fuzzer.py | 70 | except Exception as e: | CODE |
| LOW | projects/g-api-python-cloud-core/fuzz_helpers.py | 31 | except Exception: | CODE |
| LOW | projects/attrs/fuzz_attrs.py | 39 | except Exception as e: | CODE |
| LOW | projects/decorator/fuzz_funcmarker.py | 35 | except Exception as e: | CODE |
| LOW | projects/jinja2/fuzz_env_jinja_lexer.py | 33 | except Exception as e2: | CODE |
| LOW | projects/python-prompt-toolkit/fuzz_contrib.py | 27 | except Exception as e: | CODE |
| LOW | projects/g-api-auth-httplib2/fuzz_http.py | 109 | except Exception as e: | CODE |
| LOW | projects/sqlalchemy/sqlalchemy_fuzzer.py | 42 | except Exception as e: | CODE |
| MEDIUM | projects/sqlalchemy/sqlalchemy_fuzzer.py | 27 | def TestOneInput(input_bytes): | CODE |
| LOW | projects/vlc/generate_seeds.py | 4976 | except Exception as e: # pragma: no cover - Pillow optional | CODE |
| LOW | projects/vlc/generate_seeds.py | 4993 | except Exception: | CODE |
| LOW | projects/joblib/fuzz_serialization_roundtrip.py | 28 | except Exception as e: | CODE |
| LOW | projects/kafka/fuzz_consumer.py | 33 | except Exception as e: | CODE |
| LOW | projects/python-pypdf/fuzz_encryption.py | 54 | except Exception: | CODE |
| 10 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | infra/repo_manager.py | 141 | Gets the list of commits(inclusive) between the old and new commits. Args: newest_commit: The newest commit t | STRING |
| HIGH | infra/utils.py | 56 | Runs a shell command in the specified directory location. Args: command: The command as a list to be run. env | STRING |
| HIGH | infra/bisector.py | 289 | From a commit range, this function caluclates which introduced a specific error from a fuzz testcase_path. Args: | STRING |
| HIGH | infra/base-images/base-builder/detect_repo.py | 157 | Runs a shell command in the specified directory location. Args: command: The command as a list to be run. loc | STRING |
| HIGH | …fra/base-images/base-builder/indexer/manifest_types.py | 410 | Saves a build archive with this Manifest. Args: source_dir: The directory containing the source code, or None | STRING |
| HIGH | …fra/base-images/base-builder/indexer/manifest_types.py | 637 | Helper function to parse environment variables from a list. Args: env_list: A list of environment variables in th | STRING |
| HIGH | infra/base-images/base-builder/indexer/dwarf_info.py | 128 | Parses the value of a `-frecord-command-line` entry from clang. Separate arguments within a command line are combine | STRING |
| HIGH | infra/cifuzz/fuzz_target.py | 285 | Checks if the testcase reproduces. Args: testcase: The path to the testcase to be tested. target_ | STRING |
| HIGH | infra/cifuzz/fuzz_target.py | 334 | Returns True if a crash is reportable. This means the crash is reproducible but not reproducible on a build from the | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 30 | # Step 1: build the base image | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 35 | # Step 2: create a container where `compile` has run which enables ccaching | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 57 | # Step 3: save (commit, locally) the cached container as an image | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 67 | # Step 4: save the list of executables created from a vanilla build. This is | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 74 | # Step 5: Build with replay enabled, and validate the executables are the same | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 118 | # Step 8: prepare Dockerfile for ccache | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 125 | # Step 9: Build an image with CCache's new items (modifications are done on the | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 131 | # Step 10: Run a `compile` with ccache's image. | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 145 | # Step 11: extract the executables from the ccache build | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 149 | # Step 12: validate the ccache builds are successful | COMMENT |
| LOW | infra/experimental/chronos/build_cache_local.sh | 90 | # Step 6: Extract the newly build executables | COMMENT |
| LOW | infra/experimental/chronos/build_cache_local.sh | 102 | # Step 7: match executables from vanilla builds and replay builds. | COMMENT |
| LOW⚡ | infra/experimental/chronos/check_tests.sh | 32 | # Step 1: build the base image | COMMENT |
| LOW⚡ | infra/experimental/chronos/check_tests.sh | 36 | # Step 2: create a container where `compile` has run which enables ccaching | COMMENT |
| LOW⚡ | infra/experimental/chronos/check_tests.sh | 58 | # Step 3: save (commit, locally) the cached container as an image | COMMENT |
| LOW⚡ | infra/experimental/chronos/check_tests.sh | 62 | # Step 4: run the actual run_tests.sh script in the container. | COMMENT |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 148 | # Step 1: Get the token from the cookie | COMMENT |
| LOW⚡ | projects/ruby/build.sh | 21 | # Step 1: Download and install latest stable Ruby release as baseruby | COMMENT |
| LOW⚡ | projects/ruby/build.sh | 58 | # Step 2: Build target Ruby from source with static linking | COMMENT |
| LOW⚡ | projects/ruby/build.sh | 119 | # Step 3: Set up paths for fuzzer builds | COMMENT |
| LOW | docs/getting-started/new-project-guide/jvm_lang.md | 104 | # Step 1: Build the project | COMMENT |
| LOW | docs/getting-started/new-project-guide/jvm_lang.md | 119 | # Step 2: Build the fuzzers (should not require any changes) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 30 | # Step 1: build the base image | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 35 | # Step 2: create a container where `compile` has run which enables ccaching | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 57 | # Step 3: save (commit, locally) the cached container as an image | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 67 | # Step 4: save the list of executables created from a vanilla build. This is | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 74 | # Step 5: Build with replay enabled, and validate the executables are the same | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 118 | # Step 8: prepare Dockerfile for ccache | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 125 | # Step 9: Build an image with CCache's new items (modifications are done on the | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 131 | # Step 10: Run a `compile` with ccache's image. | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 145 | # Step 11: extract the executables from the ccache build | COMMENT |
| LOW⚡ | infra/experimental/chronos/build_cache_local.sh | 149 | # Step 12: validate the ccache builds are successful | COMMENT |
| LOW | infra/experimental/chronos/build_cache_local.sh | 90 | # Step 6: Extract the newly build executables | COMMENT |
| LOW | infra/experimental/chronos/build_cache_local.sh | 102 | # Step 7: match executables from vanilla builds and replay builds. | COMMENT |
| LOW⚡ | infra/experimental/chronos/check_tests.sh | 32 | # Step 1: build the base image | COMMENT |
| LOW⚡ | infra/experimental/chronos/check_tests.sh | 36 | # Step 2: create a container where `compile` has run which enables ccaching | COMMENT |
| LOW⚡ | infra/experimental/chronos/check_tests.sh | 58 | # Step 3: save (commit, locally) the cached container as an image | COMMENT |
| LOW⚡ | infra/experimental/chronos/check_tests.sh | 62 | # Step 4: run the actual run_tests.sh script in the container. | COMMENT |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 148 | # Step 1: Get the token from the cookie | COMMENT |
| LOW⚡ | projects/ruby/build.sh | 21 | # Step 1: Download and install latest stable Ruby release as baseruby | COMMENT |
| LOW⚡ | projects/ruby/build.sh | 58 | # Step 2: Build target Ruby from source with static linking | COMMENT |
| LOW⚡ | projects/ruby/build.sh | 119 | # Step 3: Set up paths for fuzzer builds | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | infra/chronos/integrity_validator_run_tests.py | 238 | # Check if there is a .git directory | COMMENT |
| LOW | infra/experimental/chronos/chronos.sh | 53 | # Check if any element in the command array contains the FUZZ_TARGET. | COMMENT |
| LOW | infra/experimental/agent-skills/copy_to_global.sh | 41 | # Check if the global skills directory exists, if not create it | COMMENT |
| LOW | …base-images/base-runner/python_coverage_runner_help.py | 59 | # Check if this file exists in our file paths: | COMMENT |
| LOW | …fra/base-images/base-builder/python_coverage_helper.py | 43 | # Check if .egg is in the path and if so we need to split it | COMMENT |
| LOW⚡ | infra/base-images/base-builder/detect_repo.py | 142 | # Check if valid git repo. | COMMENT |
| LOW⚡ | infra/base-images/base-builder/detect_repo.py | 146 | # Check if history fetch is needed. | COMMENT |
| LOW⚡ | infra/base-images/base-builder/detect_repo.py | 150 | # Check if commit is in history. | COMMENT |
| LOW | …lder/sanitizers/pysecsan/pysecsan/command_injection.py | 79 | # Check if the arguments are controlled by the fuzzer, and this given | COMMENT |
| LOW | …base-clang/checkout_build_install_llvm_ubuntu_20_04.sh | 20 | # Set this to get a full build with all binaries and libraries, as well as | COMMENT |
| LOW | …base-clang/checkout_build_install_llvm_ubuntu_24_04.sh | 20 | # Set this to get a full build with all binaries and libraries, as well as | COMMENT |
| LOW | …/base-images/base-clang/checkout_build_install_llvm.sh | 20 | # Set this to get a full build with all binaries and libraries, as well as | COMMENT |
| LOW | infra/cifuzz/config_utils.py | 119 | self.dry_run = _is_dry_run() # Check if failures should not be reported. | CODE |
| LOW | projects/lit/build.sh | 21 | # Check if the file contains the "type" field | COMMENT |
| LOW | projects/canvg/build.sh | 45 | # Check if the file contains the "type" field | COMMENT |
| LOW | projects/angular/build.sh | 21 | # Check if the file contains the "type" field | COMMENT |
| LOW | projects/angular/build.sh | 79 | # Check if the file has the "mjs" extension | COMMENT |
| LOW | projects/d3/build.sh | 21 | # Check if the file contains the "type" field | COMMENT |
| LOW | projects/libssh/build.sh | 58 | # Check if this fuzzer needs ssh_server_mock | COMMENT |
| LOW | projects/libssh/build.sh | 64 | # Check if this fuzzer needs ssh_client_mock | COMMENT |
| LOW | projects/bc-java/build.sh | 18 | # Set encoding to UTF-8 for Java compilation | COMMENT |
| LOW | projects/promise-polyfill/build.sh | 21 | # Check if the file contains the "type" field | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | infra/pr_helper_test.py | 215 | 'primary_contact': 'user@example.com', | CODE |
| LOW⚡ | infra/pr_helper_test.py | 219 | self.assertTrue(pr_helper.is_known_contributor(content, 'user@example.com')) | CODE |
| LOW⚡ | infra/pr_helper_test.py | 225 | 'vendor_ccs': ['user@example.com'], | CODE |
| LOW⚡ | infra/pr_helper_test.py | 228 | self.assertTrue(pr_helper.is_known_contributor(content, 'user@example.com')) | CODE |
| LOW⚡ | infra/pr_helper_test.py | 235 | 'auto_ccs': ['user@example.com'] | CODE |
| LOW⚡ | infra/pr_helper_test.py | 237 | self.assertTrue(pr_helper.is_known_contributor(content, 'user@example.com')) | CODE |
| LOW⚡ | infra/pr_helper_test.py | 247 | 'user@example.com')) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/getting-started/new-project-guide/jvm_lang.md | 108 | # In this example, the project is built with Maven, which typically includes the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | infra/experimental/chronos/chronos.sh | 22 | # Usage: | COMMENT |
| LOW | infra/base-images/all.sh | 24 | # Usage: | COMMENT |
| LOW | projects/spirv-tools/generate_spirv_corpus.py | 26 | # Usage: | COMMENT |
| LOW | projects/vlc/generate_seeds.py | 32 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | infra/helper.py | 108 | logger = logging.getLogger(__name__) | CODE |
| LOW | infra/common_utils.py | 50 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | infra/chronos/manager.py | 30 | logger = logging.getLogger(__name__) | CODE |
| LOW | …/base-builder/sanitizers/pysecsan/pysecsan/__init__.py | 20 | __all__ = ['add_hooks'] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | projects/ffmpeg/build.sh | 206 | # TODO: implement a better way to maintain a minimized seed corpora | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | projects/libheif/generate_seeds.py | 306 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | projects/github_scarecrow/fakelib.py | 19 | def do_something(data): | CODE |