OSS-Fuzz - continuous fuzzing for open source software.
4161 matches across 17 categories. Click a row to expand file-level details.
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | infra/test_repos.py | 1 | # Copyright 2020 Google LLC |
| LOW | infra/repo_manager_test.py | 1 | # Copyright 2019 Google LLC |
| LOW | infra/pr_helper_test.py | 1 | #!/usr/bin/env python |
| LOW | infra/helper_test.py | 1 | # Copyright 2021 Google LLC |
| LOW | infra/utils_test.py | 1 | # Copyright 2020 Google LLC |
| LOW | infra/manifest.py | 1 | #! /usr/bin/env python3 |
| LOW | infra/constants.py | 1 | # Copyright 2021 Google LLC |
| LOW | infra/repo_manager.py | 1 | # Copyright 2019 Google LLC |
| LOW | infra/build_specified_commit.py | 1 | # Copyright 2019 Google LLC |
| LOW | infra/retry.py | 1 | # Copyright 2020 Google LLC |
| LOW | infra/templates.py | 1 | # Copyright 2016 Google Inc. |
| LOW | infra/templates.py | 21 | primary_contact: "<primary_contact_email>" |
| LOW | infra/templates.py | 61 | # |
| LOW | infra/templates.py | 81 | |
| LOW | infra/utils.py | 1 | # Copyright 2020 Google LLC |
| LOW | infra/presubmit.py | 1 | #!/usr/bin/env python3 |
| LOW | infra/helper.py | 1 | #!/usr/bin/env python |
| LOW | infra/pr_helper.py | 1 | #!/usr/bin/env python |
| LOW | infra/build_specified_commit_test.py | 1 | # Copyright 2019 Google LLC |
| LOW | infra/bisector.py | 1 | # Copyright 2019 Google LLC |
| LOW | infra/common_utils.py | 1 | # Copyright 2025 Google LLC |
| LOW | infra/bisector_test.py | 1 | # Copyright 2019 Google LLC |
| LOW | infra/chronos/integrity_validator_check_replay.py | 1 | # Copyright 2025 Google LLC |
| LOW | infra/chronos/container_patch_replay_test.sh | 1 | #!/bin/bash -eux |
| LOW | infra/chronos/container_coverage_collection.sh | 1 | #!/bin/bash -eux |
| LOW | infra/chronos/integrity_validator_run_tests.py | 1 | # Copyright 2025 Google LLC |
| LOW | infra/chronos/__init__.py | 1 | #!/bin/bash -eux |
| LOW | infra/chronos/container_cache_build.sh | 1 | #!/bin/bash -eux |
| LOW | infra/chronos/coverage_test_collection.py | 1 | #!/bin/bash -eux |
| LOW | infra/chronos/container_patch_tests_test.sh | 1 | #!/bin/bash -eux |
| LOW | infra/chronos/manager.py | 1 | # Copyright 2025 Google LLC |
| LOW | infra/experimental/chronos/match_artifacts.sh | 1 | #!/usr/bin/bash -eux |
| LOW | infra/experimental/chronos/build_on_cloudbuild.sh | 1 | #!/bin/bash |
| LOW | infra/experimental/chronos/build_all.sh | 1 | #!/bin/bash |
| LOW | infra/experimental/chronos/cloudbuild_all.yaml | 1 | # Copyright 2024 Google LLC |
| LOW | infra/experimental/chronos/cloudbuild.yaml | 1 | # Copyright 2024 Google LLC |
| LOW | infra/experimental/chronos/build_cache_local.sh | 1 | #!/bin/bash -eu |
| LOW | infra/experimental/chronos/check_tests.sh | 1 | #!/bin/bash |
| LOW | infra/experimental/chronos/chronos.sh | 1 | # Copyright 2024 Google LLC |
| LOW | infra/experimental/chronos/e2e-replay-build.sh | 1 | #!/usr/bin/bash |
| LOW | infra/experimental/agent-skills/copy_to_global.sh | 1 | #!/bin/bash -eu |
| LOW | infra/experimental/agent-skills/helper.py | 1 | #!/usr/bin/env python3 |
| LOW | infra/experimental/mcp/config.py | 1 | # Copyright 2025 Google LLC |
| LOW | infra/experimental/mcp/client.py | 1 | # Copyright 2025 Google LLC |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 1 | # Copyright 2025 Google LLC |
| LOW | infra/experimental/SystemSan/SystemSan.cpp | 21 | #include <stdio.h> |
| LOW | …oEs/pytorch-lightning-1.5.10/fuzz_pytorch_lightning.py | 1 | #!/usr/local/bin/python3 |
| LOW | …ental/SystemSan/PoEs/pytorch-lightning-1.5.10/build.sh | 1 | #!/bin/bash -eu |
| LOW | …mental/SystemSan/PoEs/node-shell-quote-v1.7.3/build.sh | 1 | #!/bin/bash -eu |
| LOW | infra/tools/hold_back_images.py | 1 | #!/usr/bin/env python |
| LOW | infra/tools/wycheproof/run.py | 1 | #!/usr/bin/env python3 |
| LOW | infra/tools/wycheproof/package.bash | 1 | #!/bin/bash |
| LOW | infra/tools/wycheproof/launcher.py | 1 | #!/usr/bin/env python |
| LOW | infra/tools/wycheproof/generate_job.py | 1 | #!/usr/bin/env python3 |
| LOW | infra/ci/build.py | 1 | #!/usr/bin/env python |
| LOW | infra/ci/build_test.py | 1 | # Copyright 2020 Google LLC |
| LOW | infra/ci/check_base_os.py | 1 | # Copyright 2025 Google LLC |
| LOW | infra/base-images/list_images.py | 1 | # Copyright 2025 Google LLC |
| LOW | infra/base-images/all.sh | 1 | #!/bin/bash -eux |
| LOW | infra/base-images/all.sh | 21 | # official list of images from the Python source of truth, ensuring it never |
| 2879 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | infra/experimental/mcp/oss_fuzz_server.py | 40 | # Create an MCP server with a name |
| MEDIUM | infra/experimental/mcp/oss_fuzz_server.py | 138 | max_length = 5000 # Define a maximum length for logs |
| MEDIUM | infra/base-images/base-builder/make_build_replayable.py | 78 | # Create a shell wrapper that stubs out `configure` and `autogen`. |
| MEDIUM | …/base-images/base-builder/install_deps_ubuntu-24-04.sh | 51 | # Create a custom apt configuration to allow downgrades and non-interactive installs. |
| MEDIUM | …cifuzz/filestore/github_actions/github_actions_test.py | 201 | # Create a tarball. |
| MEDIUM | projects/jansi/build.sh | 40 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/nimbus-jwt/build.sh | 67 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/cbor-java/build.sh | 32 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/stax/build.sh | 69 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/spring-shell/build.sh | 52 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/apache-commons-cli/build.sh | 39 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/checker-framework/build.sh | 48 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/calcite/build.sh | 68 | # Create an execution wrapper for every fuzztarget |
| MEDIUM | projects/opt_einsum/fuzz_parser.py | 25 | # Create a numpy array with fuzzer-seeded entries. |
| MEDIUM | projects/hamcrest/build.sh | 41 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/apache-commons-fileupload/build.sh | 66 | # Create an execution wrapper for every fuzztarget |
| MEDIUM | projects/javassist/build.sh | 46 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/qdox/build.sh | 70 | # Create an execution wrapper for every fuzztarget |
| MEDIUM | projects/apache-commons-codec/build.sh | 38 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/graphql-java/build.sh | 61 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/json-simple/build.sh | 64 | # Create an execution wrapper for every fuzztarget |
| MEDIUM | projects/py-serde/fuzz_model.py | 28 | # Create an arbitrary Model structure |
| MEDIUM | projects/jul-to-slf4j/build.sh | 38 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/jts/build.sh | 45 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/jackson-databind/build.sh | 65 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/snakeyaml/build.sh | 40 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/spring-cloud-stream/build.sh | 55 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/netty-tcnative/build.sh | 46 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/ohc/build.sh | 42 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/presto/build.sh | 74 | # Create an execution wrapper for every fuzztarget |
| MEDIUM | projects/spring-data-jpa/build.sh | 42 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/jsch/build.sh | 67 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/feign/build.sh | 61 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/checkstyle/build.sh | 52 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/spring-cloud-commons/build.sh | 80 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/dom4j/build.sh | 38 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/g-auth-library-java/build.sh | 70 | # Create an execution wrapper for every fuzztarget |
| MEDIUM | projects/httpcomponents-core/build.sh | 40 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/async-http-client/build.sh | 70 | # Create an execution wrapper for every fuzztarget |
| MEDIUM | projects/pdfbox/build.sh | 69 | # Create an execution wrapper for every fuzztarget |
| MEDIUM | projects/gson/build.sh | 40 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/reflections/build.sh | 45 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/jooq/build.sh | 65 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/kie-soup/build.sh | 40 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/jsqlparser/build.sh | 69 | # Create an execution wrapper for every fuzztarget |
| MEDIUM | projects/jackson-datatype-joda/build.sh | 45 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/apache-commons-collections/build.sh | 45 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/lucene/build.sh | 45 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/open-json/build.sh | 43 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/junrar/build.sh | 42 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/univocity-parsers/build.sh | 70 | # Create an execution wrapper for every fuzztarget |
| MEDIUM | projects/spring-integration/build.sh | 48 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/mvel/build.sh | 66 | # Create an execution wrapper for every fuzztarget |
| MEDIUM | projects/antlr3-java/build.sh | 39 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/xmlunit/build.sh | 46 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/jersey/build.sh | 44 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/tomcat/build.sh | 54 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/apache-commons-math/build.sh | 40 | # Create an execution wrapper that executes Jazzer with the correct arguments. |
| MEDIUM | projects/apache-tika/build.sh | 53 | # Create an execution wrapper for every fuzztarget |
| MEDIUM | projects/closure-compiler/build.sh | 65 | # Create an execution wrapper for every fuzztarget |
| 188 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | infra/helper.py | 20 | |
| LOW | infra/helper.py | 28 | |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 41 | |
| LOW | infra/ci/build.py | 19 | |
| LOW | …/base-builder/sanitizers/pysecsan/pysecsan/__init__.py | 17 | |
| LOW | infra/cifuzz/fuzz_target_test.py | 26 | |
| LOW | infra/cifuzz/filestore/gsutil/__init__.py | 18 | |
| LOW | infra/cifuzz/filestore/gitlab/__init__.py | 17 | |
| LOW | infra/cifuzz/filestore/gitlab/__init__.py | 20 | |
| LOW | infra/cifuzz/filestore/gitlab/__init__.py | 23 | |
| LOW | infra/cifuzz/filestore/filesystem/__init__.py | 15 | |
| LOW | infra/cifuzz/filestore/filesystem/__init__.py | 17 | |
| LOW | infra/cifuzz/filestore/filesystem/__init__.py | 18 | |
| LOW | projects/psqlparse/fuzz_parse.py | 20 | |
| LOW | projects/psqlparse/fuzz_parse.py | 26 | |
| LOW | projects/flask/cors_fuzz_flask.py | 19 | |
| LOW | projects/mdit-py-plugins/fuzz_containers.py | 20 | |
| LOW | projects/mdit-py-plugins/fuzz_plugins_individually.py | 20 | |
| LOW | projects/keras/fuzz_model.py | 17 | |
| LOW | projects/keras/fuzz_model.py | 18 | |
| LOW | projects/keras/fuzz_model.py | 19 | |
| LOW | projects/keras/fuzz_serialization.py | 19 | |
| LOW | projects/aiohttp/fuzz_http_parser.py | 32 | |
| LOW | projects/aiohttp/fuzz_http_payload_parser.py | 31 | |
| LOW | projects/aiohttp/fuzz_payload_url.py | 21 | |
| LOW | projects/aiohttp/fuzz_web_request.py | 16 | |
| LOW | projects/aiohttp/fuzz_web_request.py | 23 | |
| LOW | projects/pyasn1/fuzz_decode.py | 16 | |
| LOW | projects/pem/fuzz_pem.py | 16 | |
| LOW | projects/py-serde/fuzz_model.py | 16 | |
| LOW | projects/ffmpeg/group_seed_corpus.py | 18 | |
| LOW | projects/pymysql/fuzz_connection.py | 24 | |
| LOW | projects/toolz/fuzz_itertoolz.py | 18 | |
| LOW | projects/toolz/fuzz_itertoolz.py | 18 | |
| LOW | projects/toolz/fuzz_itertoolz.py | 18 | |
| LOW | projects/defusedxml/fuzz_etree_parse.py | 20 | |
| LOW | projects/defusedxml/fuzz_parse_string.py | 22 | |
| LOW | projects/attrs/fuzz_attrs.py | 22 | |
| LOW | projects/pyrsistent/fuzz_vector.py | 16 | |
| LOW | projects/oauthlib/fuzz_oauth1_sig.py | 16 | |
| LOW | projects/pygments/fuzz_lexers.py | 21 | |
| LOW | projects/mako/fuzz_lexer.py | 15 | |
| LOW | projects/retry/fuzz_retry.py | 19 | |
| LOW | projects/decorator/fuzz_decorator.py | 18 | |
| LOW | projects/decorator/fuzz_decorator.py | 20 | |
| LOW | projects/decorator/fuzz_funcmarker.py | 18 | |
| LOW | projects/decorator/fuzz_funcmarker.py | 20 | |
| LOW | projects/dask/fuzz_fuse.py | 18 | |
| LOW | projects/g-api-py-oauthlib/fuzz_config.py | 16 | |
| LOW | projects/docutils/fuzz_rst.py | 24 | |
| LOW | projects/docutils/fuzz_rst.py | 25 | |
| LOW | projects/docutils/fuzz_rst.py | 25 | |
| LOW | projects/abseil-py/fuzz_argparse.py | 22 | |
| LOW | projects/et-xmlfile/fuzz_write.py | 16 | |
| LOW | projects/et-xmlfile/fuzz_write.py | 22 | |
| LOW | projects/pyparsing/fuzz_parse.py | 16 | |
| LOW | projects/angle/gen_clones.py | 17 | |
| LOW | projects/grpc-py/fuzz_server.py | 21 | |
| LOW | projects/grpc-py/fuzz_server.py | 27 | |
| LOW | projects/grpc-py/fuzz_server.py | 30 | |
| 288 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | infra/repo_manager_test.py | 45 | def test_clone_valid_repo_integration(self): |
| LOW | infra/repo_manager_test.py | 79 | def test_checkout_valid_commit(self): |
| LOW | infra/repo_manager_test.py | 87 | def test_checkout_invalid_commit(self): |
| LOW | infra/repo_manager_test.py | 104 | def test_get_valid_commit_list(self): |
| LOW | infra/repo_manager_test.py | 119 | def test_get_invalid_commit_list(self): |
| LOW | infra/repo_manager_test.py | 188 | def test_checkout_invalid_pull_request(self): |
| LOW | infra/pr_helper_test.py | 97 | def test_save_env_newline_injection_blocked(self): |
| LOW | infra/pr_helper_test.py | 105 | def test_save_env_carriage_return_injection_blocked(self): |
| LOW | infra/pr_helper_test.py | 112 | def test_save_env_injection_via_all_fields(self): |
| LOW | infra/pr_helper_test.py | 120 | def test_save_env_none_values(self, mock_uuid): |
| LOW | infra/pr_helper_test.py | 129 | def test_save_env_full_attack_scenario(self): |
| LOW | infra/pr_helper_test.py | 165 | def test_url_with_newline_injection(self): |
| LOW | infra/pr_helper_test.py | 172 | def test_url_with_carriage_return(self): |
| LOW | infra/pr_helper_test.py | 195 | def test_invalid_scheme_rejected(self): |
| LOW | infra/pr_helper_test.py | 201 | def test_ssh_url_with_newline_injection(self): |
| LOW | infra/pr_helper_test.py | 212 | def test_primary_contact_match(self): |
| LOW | infra/helper_test.py | 139 | def test_generate_oss_fuzz_project(self, _): |
| LOW | infra/helper_test.py | 148 | def test_generate_external_project(self): |
| LOW | infra/helper_test.py | 161 | def test_generate_swift_project(self, _): |
| LOW | infra/helper_test.py | 181 | def test_init_external_project(self): |
| LOW | infra/helper_test.py | 190 | def test_init_internal_project(self): |
| LOW | infra/helper_test.py | 197 | def test_dockerfile_path_internal_project(self): |
| LOW | infra/helper_test.py | 204 | def test_dockerfile_path_external_project(self): |
| LOW | infra/helper_test.py | 236 | def test_language_internal_project(self): |
| LOW | infra/helper_test.py | 242 | def test_language_external_project(self): |
| LOW | infra/repo_manager.py | 235 | def clone_repo_and_get_manager(repo_url, |
| LOW | infra/build_specified_commit.py | 104 | def _replace_base_builder_digest(dockerfile_path, digest): |
| LOW | infra/build_specified_commit.py | 147 | def _build_image_with_retries(project_name): |
| LOW | infra/build_specified_commit.py | 152 | def get_required_post_checkout_steps(dockerfile_path): |
| LOW | infra/build_specified_commit.py | 180 | def build_fuzzers_from_commit(commit, |
| LOW | infra/presubmit.py | 50 | def _check_one_lib_fuzzing_engine(build_sh_file): |
| LOW | infra/presubmit.py | 157 | def check_project_yaml_constants(self): |
| LOW | infra/presubmit.py | 179 | def check_valid_section_names(self): |
| LOW | infra/helper.py | 210 | def _add_external_project_args(parser): |
| LOW | infra/helper.py | 939 | def _add_oss_fuzz_ci_if_needed(env): |
| LOW | infra/helper.py | 1051 | def _get_latest_public_corpus(args, fuzzer): |
| LOW | infra/helper.py | 1129 | def _download_for_single_target(fuzz_target): |
| LOW | infra/helper.py | 1222 | def _introspector_prepare_corpus(args): |
| LOW | infra/helper.py | 1556 | def _create_build_integration_directory(directory): |
| LOW | infra/helper.py | 1591 | def _base_builder_from_language(language): |
| LOW | infra/pr_helper.py | 235 | def get_integrated_project_info(self): |
| LOW | infra/pr_helper.py | 304 | def is_author_internal_member(self): |
| LOW | infra/pr_helper.py | 308 | def has_author_modified_project(self, project_path): |
| LOW | infra/build_specified_commit_test.py | 39 | def test_build_fuzzers_from_commit(self): |
| LOW | infra/build_specified_commit_test.py | 81 | def test_detect_main_repo_from_commit(self): |
| LOW | infra/build_specified_commit_test.py | 101 | def test_detect_main_repo_from_name(self): |
| LOW | infra/chronos/integrity_validator_check_replay.py | 51 | def source_code_compile_error(): |
| LOW | infra/chronos/integrity_validator_run_tests.py | 36 | def _add_payload_random_functions(exts: list[str], payload: str) -> str: |
| LOW | infra/chronos/coverage_test_collection.py | 26 | def collect_coverage_profraw_files(): |
| LOW | infra/chronos/manager.py | 39 | def _get_project_cached_named(project: common_utils.Project, |
| LOW | infra/chronos/manager.py | 46 | def _get_project_cached_named_local(project: common_utils.Project, |
| LOW | infra/chronos/manager.py | 422 | def cmd_dispatcher_check_tests(args): |
| LOW | infra/chronos/manager.py | 430 | def cmd_dispatcher_check_replay(args): |
| LOW | infra/chronos/manager.py | 437 | def cmd_dispatcher_build_cached_image(args): |
| LOW | infra/chronos/manager.py | 442 | def cmd_dispatcher_extract_coverage(args): |
| LOW | infra/experimental/agent-skills/helper.py | 811 | def cleanup_project_artifacts(project): |
| LOW | infra/experimental/agent-skills/helper.py | 910 | def _run_single_integrate_session(agent_cli, project_url): |
| LOW | infra/experimental/agent-skills/helper.py | 1125 | def build_consolidation_prompt(project): |
| LOW | infra/experimental/agent-skills/helper.py | 1138 | def launch_consolidation_session(agent_cli, project): |
| LOW | infra/experimental/agent-skills/helper.py | 1177 | def _run_single_consolidation_session(agent_cli, project): |
| 215 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| HIGH | infra/common_utils.py | 0 | returns the out dir for the project. creates it if needed. |
| HIGH | infra/common_utils.py | 0 | returns the out dir for the project. creates it if needed. |
| HIGH | infra/common_utils.py | 0 | returns the out dir for the project. creates it if needed. |
| HIGH | infra/cifuzz/run_fuzzers.py | 0 | fuzzes with |fuzz_target_obj| and returns the result. |
| HIGH | infra/cifuzz/run_fuzzers.py | 0 | fuzzes with |fuzz_target_obj| and returns the result. |
| HIGH | infra/cifuzz/run_fuzzers.py | 0 | fuzzes with |fuzz_target_obj| and returns the result. |
| HIGH | infra/cifuzz/clusterfuzz_deployment.py | 0 | returns the project coverage object for the project. |
| HIGH | infra/cifuzz/clusterfuzz_deployment.py | 0 | returns the project coverage object for the project. |
| HIGH | infra/cifuzz/clusterfuzz_deployment.py | 0 | returns the project coverage object for the project. |
| HIGH | infra/cifuzz/get_coverage_test.py | 0 | tests that covered files can be retrieved from a coverage report. |
| HIGH | infra/cifuzz/get_coverage_test.py | 0 | tests that covered files can be retrieved from a coverage report. |
| HIGH | infra/cifuzz/get_coverage_test.py | 0 | tests that covered files can be retrieved from a coverage report. |
| HIGH | infra/cifuzz/config_utils_test.py | 0 | tests that validate returns false if github_workspace isn't set. |
| HIGH | infra/cifuzz/config_utils_test.py | 0 | tests that validate returns false if github_workspace isn't set. |
| HIGH | infra/cifuzz/config_utils_test.py | 0 | tests that validate returns false if github_workspace isn't set. |
| HIGH | infra/cifuzz/get_coverage.py | 0 | get the coverage report for a specific fuzz target. args: target: the name of the fuzz target whose coverage is requeste |
| HIGH | infra/cifuzz/get_coverage.py | 0 | get the coverage report for a specific fuzz target. args: target: the name of the fuzz target whose coverage is requeste |
| HIGH | infra/cifuzz/get_coverage.py | 0 | get the coverage report for a specific fuzz target. args: target: the name of the fuzz target whose coverage is requeste |
| HIGH | infra/cifuzz/continuous_integration.py | 0 | returns the source repo path, if it has been checked out. none is returned otherwise. |
| HIGH | infra/cifuzz/continuous_integration.py | 0 | returns the source repo path, if it has been checked out. none is returned otherwise. |
| HIGH | infra/cifuzz/continuous_integration.py | 0 | returns the source repo path, if it has been checked out. none is returned otherwise. |
| HIGH | infra/cifuzz/continuous_integration.py | 0 | returns the source repo path, if it has been checked out. none is returned otherwise. |
| HIGH | infra/cifuzz/continuous_integration.py | 0 | returns the command for building the project that is run inside the project builder container. |
| HIGH | infra/cifuzz/continuous_integration.py | 0 | returns the command for building the project that is run inside the project builder container. |
| HIGH | infra/cifuzz/continuous_integration.py | 0 | returns the command for building the project that is run inside the project builder container. |
| HIGH | infra/cifuzz/filestore/__init__.py | 0 | uploads the coverage report at |directory| to |name|. |
| HIGH | infra/cifuzz/filestore/gsutil/__init__.py | 0 | uploads the coverage report at |directory| to |name|. |
| HIGH | infra/cifuzz/filestore/filesystem/__init__.py | 0 | uploads the coverage report at |directory| to |name|. |
| HIGH | infra/cifuzz/filestore/github_actions/__init__.py | 0 | uploads the coverage report at |directory| to |name|. |
| HIGH | infra/cifuzz/filestore/git/__init__.py | 0 | uploads the coverage report at |directory| to |name|. |
| HIGH | infra/cifuzz/filestore/__init__.py | 0 | downloads the corpus located at |name| to |dst_directory|. |
| HIGH | infra/cifuzz/filestore/gsutil/__init__.py | 0 | downloads the corpus located at |name| to |dst_directory|. |
| HIGH | infra/cifuzz/filestore/filesystem/__init__.py | 0 | downloads the corpus located at |name| to |dst_directory|. |
| HIGH | infra/cifuzz/filestore/github_actions/__init__.py | 0 | downloads the corpus located at |name| to |dst_directory|. |
| HIGH | infra/cifuzz/filestore/git/__init__.py | 0 | downloads the corpus located at |name| to |dst_directory|. |
| HIGH | infra/cifuzz/filestore/__init__.py | 0 | downloads the build with |name| to |dst_directory|. |
| HIGH | infra/cifuzz/filestore/gsutil/__init__.py | 0 | downloads the build with |name| to |dst_directory|. |
| HIGH | infra/cifuzz/filestore/filesystem/__init__.py | 0 | downloads the build with |name| to |dst_directory|. |
| HIGH | infra/cifuzz/filestore/git/__init__.py | 0 | downloads the build with |name| to |dst_directory|. |
| HIGH | infra/cifuzz/platform_config/standalone.py | 0 | returns the filestore used to store persistent data. |
| HIGH | infra/cifuzz/platform_config/standalone.py | 0 | returns the filestore used to store persistent data. |
| HIGH | infra/cifuzz/platform_config/gitlab.py | 0 | returns the filestore used to store persistent data. |
| HIGH | infra/cifuzz/platform_config/__init__.py | 0 | returns the filestore used to store persistent data. |
| HIGH | infra/cifuzz/platform_config/gcb.py | 0 | returns the filestore used to store persistent data. |
| HIGH | infra/cifuzz/platform_config/prow.py | 0 | returns the filestore used to store persistent data. |
| HIGH | infra/cifuzz/platform_config/github_test.py | 0 | tests that the correct result is returned when repository contains the owner and repo name (as it does on github). |
| HIGH | infra/cifuzz/platform_config/github_test.py | 0 | tests that the correct result is returned when repository contains the owner and repo name (as it does on github). |
| HIGH | infra/cifuzz/platform_config/github_test.py | 0 | tests that the correct result is returned when repository contains the owner and repo name (as it does on github). |
| HIGH | infra/cifuzz/platform_config/__init__.py | 0 | returns the base commit to diff against (commit fuzzing). |
| HIGH | infra/cifuzz/platform_config/prow.py | 0 | returns the base commit to diff against (commit fuzzing). |
| HIGH | infra/cifuzz/platform_config/github.py | 0 | returns the base commit to diff against (commit fuzzing). |
| HIGH | infra/cifuzz/platform_config/__init__.py | 0 | returns the base branch to diff against (pr fuzzing). |
| HIGH | infra/cifuzz/platform_config/prow.py | 0 | returns the base branch to diff against (pr fuzzing). |
| HIGH | infra/cifuzz/platform_config/github.py | 0 | returns the base branch to diff against (pr fuzzing). |
| Severity | File | Line | Snippet |
|---|---|---|---|
| CRITICAL | …ects/jackson-datatype-joda/JodaDeserializerFuzzer.java | 53 | mapper = tools.jackson.databind.json.JsonMapper.builder() |
| CRITICAL | …ojects/jackson-datatype-joda/JodaSerializerFuzzer.java | 39 | mapper = tools.jackson.databind.json.JsonMapper.builder() |
| CRITICAL | …ojects/jackson-datatype-joda/JodaSerializerFuzzer.java | 49 | mapper = tools.jackson.databind.json.JsonMapper.builder() |
| CRITICAL | …/org/apache/struts/test/StrutsSimpleRequestFuzzer.java | 41 | com.code_intelligence.jazzer.api.BugDetectors.allowNetworkConnections(); |
| CRITICAL | …rc/main/java/ossfuzz/ConfigServerPropertiesFuzzer.java | 33 | ConfigServerProperties config = new org.springframework.cloud.config.server.config.ConfigServerProperties(); |
| CRITICAL | projects/powsybl-java/ParseFuzzer.java | 176 | "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\"" |
| CRITICAL | projects/powsybl-java/DeserializeFuzzer.java | 295 | "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\"" |
| CRITICAL | projects/powsybl-java/MetrixFuzzer.java | 300 | "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\"" |
| CRITICAL | projects/powsybl-java/LoadFlowFuzzer.java | 252 | "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\"" |
| CRITICAL | projects/powsybl-java/OpenRaoFuzzer.java | 142 | "Cannot invoke \"com.fasterxml.jackson.databind.JsonNode.get(String)\"" |
| CRITICAL | projects/swagger-core/YamlFuzzer.java | 26 | io.swagger.v3.core.util.Yaml31.jsonSchemaAsMap(data.consumeRemainingAsString()); |
| CRITICAL | …nit-fuzzer/src/main/java/ossfuzz/HtmlParserFuzzer.java | 48 | com.code_intelligence.jazzer.api.BugDetectors.allowNetworkConnections(); |
| Severity | File | Line | Snippet |
|---|---|---|---|
| HIGH | infra/templates.py | 44 | RUN apt-get update && apt-get install -y make autoconf automake libtool |
| HIGH | infra/templates.py | 52 | RUN apt-get update && apt-get install -y make autoconf automake libtool |
| HIGH | infra/chronos/manager.py | 176 | base_cmd = 'export PATH=/ccache/bin:$PATH && rm -rf /out/* && compile' |
| HIGH | infra/experimental/agent-skills/helper.py | 972 | print(f' cd {OSS_FUZZ_ROOT} && git diff && git status') |
| HIGH | infra/experimental/mcp/client.py | 659 | cd $GOPATH/src/$path || true |
| HIGH | infra/experimental/mcp/client.py | 661 | go mod tidy || true |
| HIGH | infra/experimental/mcp/client.py | 665 | go list $tags $path || { go mod init $path && go mod tidy ;} |
| HIGH | infra/experimental/mcp/client.py | 679 | abspath_repo=`go list -m $tags -f {{.Dir}} $fuzzed_repo || go list $tags -f {{.Dir}} $fuzzed_repo` |
| HIGH | infra/experimental/mcp/client.py | 688 | abspath_repo=`go list -m $tags -f {{.Dir}} $GO_COV_ADD_PKG || go list $tags -f {{.Dir}} $GO_COV_ADD_PKG` |
| HIGH | infra/experimental/mcp/client.py | 850 | RUN apt-get update && apt-get install -y make autoconf automake libtool |
| HIGH | infra/experimental/contrib/arvo/arvo_reproducer.py | 641 | f"git reset --hard $commit || exit 99) ; " |
| HIGH | infra/experimental/contrib/arvo/arvo_reproducer.py | 642 | f"(git submodule init && git submodule update --force) ;popd'") |
| HIGH | infra/experimental/contrib/arvo/arvo_reproducer.py | 649 | f"git reset --hard $commit || exit 99) ; " |
| HIGH | infra/experimental/contrib/arvo/arvo_reproducer.py | 650 | f"(git submodule init && git submodule update --force) ;popd'") |
| HIGH | infra/experimental/contrib/arvo/arvo_data.py | 73 | r'RUN apt', "RUN apt update -y && apt install git ca-certificates -y && " |
| HIGH | infra/experimental/contrib/arvo/hacks/imagemagick.py | 14 | "RUN mkdir /src/heic_corpus && touch /src/heic_corpus/XxX") |
| HIGH | infra/experimental/contrib/arvo/hacks/libreoffice.py | 42 | line, 'echo "pushd instdir/program && mv *fuzzer $OUT" >> ' |
| HIGH | infra/cifuzz/continuous_integration_test.py | 66 | 'cp -r /path/on/host/to/repo /src && cd - ' |
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | projects/phosphor-host-ipmid/build.sh | 126 | # ============================================================ |
| MEDIUM | projects/phosphor-host-ipmid/build.sh | 128 | # ============================================================ |
| MEDIUM | projects/vlc/generate_seeds.py | 41 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 43 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 245 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 247 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 353 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 359 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 1257 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 1259 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 1456 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 1460 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 1694 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 1696 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 1798 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 1800 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 1982 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 1984 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 2469 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 2471 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 2546 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 2548 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 2752 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 2754 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 2809 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 2821 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 2987 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 2999 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 3085 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 3087 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 3245 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 3247 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 3438 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 3440 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 3725 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 3727 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 3958 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 3960 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 2524 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/vlc/generate_seeds.py | 2526 | # ────────────────────────────────────────────────── |
| MEDIUM | projects/open62541/build.sh | 118 | # ── Master branch (no suffix) ──────────────────────────────────────────────── |
| MEDIUM | projects/open62541/build.sh | 127 | # ── 1.5 branch (_15 suffix) ────────────────────────────────────────────────── |
| MEDIUM | projects/clamav/build.sh | 62 | # ---------- |
| MEDIUM | projects/ruby/build.sh | 22 | # ===================================================================== |
| MEDIUM | projects/ruby/build.sh | 59 | # =========================================================== |
| MEDIUM | projects/ruby/build.sh | 120 | # ======================================== |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | infra/retry.py | 81 | except Exception as error: |
| LOW | infra/retry.py | 98 | except Exception as error: |
| MEDIUM | infra/presubmit.py | 62 | print('Error: build.sh contains deprecated "-lFuzzingEngine" on line: ' |
| MEDIUM | infra/presubmit.py | 145 | print(f'Error in {self.filename}: {message}') |
| LOW | infra/helper.py | 1136 | except Exception as error: # pylint:disable=broad-except |
| MEDIUM | infra/helper.py | 1129 | def _download_for_single_target(fuzz_target): |
| MEDIUM | infra/bisector.py | 119 | print('Error was introduced at commit %s' % result.commit) |
| MEDIUM | infra/bisector.py | 121 | print('Error was fixed at commit %s' % result.commit) |
| LOW | infra/chronos/integrity_validator_check_replay.py | 47 | except Exception: |
| LOW | infra/chronos/integrity_validator_check_replay.py | 65 | except Exception: |
| LOW | infra/chronos/integrity_validator_check_replay.py | 83 | except Exception: |
| LOW | infra/chronos/integrity_validator_check_replay.py | 120 | except Exception: |
| LOW | infra/chronos/integrity_validator_check_replay.py | 154 | except Exception: |
| LOW | infra/chronos/integrity_validator_check_replay.py | 174 | except Exception: |
| LOW | infra/chronos/integrity_validator_check_replay.py | 209 | except Exception: |
| LOW | infra/chronos/integrity_validator_run_tests.py | 59 | except Exception: |
| LOW | infra/chronos/integrity_validator_run_tests.py | 89 | except Exception: |
| LOW | infra/chronos/integrity_validator_run_tests.py | 143 | except Exception: |
| LOW | infra/chronos/integrity_validator_run_tests.py | 180 | except Exception: |
| LOW | infra/experimental/mcp/client.py | 206 | except Exception as e: |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 378 | except Exception as e: |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 404 | except Exception as e: |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 435 | except Exception as e: |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 451 | except Exception as e: |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 478 | except Exception as e: |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 506 | except Exception as e: |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 185 | except Exception: |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 1045 | except Exception: |
| MEDIUM | infra/ci/check_base_os.py | 74 | print(f'Error: Dockerfile not found at {dockerfile_path}', file=sys.stderr) |
| MEDIUM | infra/ci/check_base_os.py | 89 | print(f'Error: Could not parse tag from Dockerfile FROM line: {line}', |
| LOW | …r/sanitizers/pysecsan/pysecsan/yaml_deserialization.py | 23 | except Exception: |
| LOW | …fra/base-images/base-builder/indexer/manifest_types.py | 499 | except Exception as e: # pylint: disable=broad-except |
| LOW | infra/base-images/base-builder/indexer/index_build.py | 714 | except Exception: # pylint: disable=broad-exception-caught |
| LOW | infra/cifuzz/clusterfuzz_deployment.py | 136 | except Exception as err: # pylint: disable=broad-except |
| LOW | infra/cifuzz/clusterfuzz_deployment.py | 150 | except Exception as err: # pylint: disable=broad-except |
| LOW | infra/cifuzz/clusterfuzz_deployment.py | 169 | except Exception as err: # pylint: disable=broad-except |
| LOW | infra/cifuzz/clusterfuzz_deployment.py | 181 | except Exception as err: # pylint: disable=broad-except |
| LOW | infra/cifuzz/clusterfuzz_deployment.py | 203 | except Exception as err: # pylint: disable=broad-except |
| LOW | infra/cifuzz/clusterfuzz_deployment.py | 221 | except Exception as err: # pylint: disable=broad-except |
| LOW | infra/cifuzz/http_utils.py | 72 | except Exception: # pylint: disable=broad-except |
| LOW | infra/cifuzz/config_utils.py | 232 | except Exception: # pylint: disable=broad-except |
| LOW | projects/flask/cors_fuzz_flask.py | 78 | except Exception: |
| LOW | projects/flask/cors_fuzz_flask.py | 89 | except Exception as e: |
| LOW | projects/aiohttp/fuzz_web_request.py | 34 | except Exception: |
| LOW | projects/ujson/json_differential_fuzzer.py | 70 | except Exception as e: |
| LOW | projects/g-api-python-cloud-core/fuzz_helpers.py | 31 | except Exception: |
| LOW | projects/attrs/fuzz_attrs.py | 39 | except Exception as e: |
| LOW | projects/decorator/fuzz_funcmarker.py | 35 | except Exception as e: |
| LOW | projects/jinja2/fuzz_env_jinja_lexer.py | 33 | except Exception as e2: |
| LOW | projects/python-prompt-toolkit/fuzz_contrib.py | 27 | except Exception as e: |
| LOW | projects/g-api-auth-httplib2/fuzz_http.py | 109 | except Exception as e: |
| LOW | projects/sqlalchemy/sqlalchemy_fuzzer.py | 42 | except Exception as e: |
| MEDIUM | projects/sqlalchemy/sqlalchemy_fuzzer.py | 27 | def TestOneInput(input_bytes): |
| LOW | projects/joblib/fuzz_serialization_roundtrip.py | 28 | except Exception as e: |
| LOW | projects/kafka/fuzz_consumer.py | 33 | except Exception as e: |
| LOW | projects/python-pypdf/fuzz_encryption.py | 54 | except Exception: |
| LOW | projects/pyodbc/fuzz_curs_exec.py | 33 | except Exception as e: |
| LOW | projects/flask-restx/fuzz_reqparse.py | 42 | except Exception as e2: |
| LOW | projects/glom/fuzz_core.py | 45 | except Exception: |
| LOW | projects/glom/fuzz_mutation.py | 36 | except Exception: |
| 6 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | infra/retry.py | 36 | |
| LOW | infra/retry.py | 47 | |
| LOW | infra/retry.py | 70 | |
| LOW | infra/retry.py | 86 | |
| LOW | infra/presubmit.py | 157 | |
| LOW | infra/helper.py | 116 | |
| LOW | infra/pr_helper.py | 95 | |
| LOW | infra/bisector.py | 177 | |
| LOW | infra/common_utils.py | 227 | |
| LOW | infra/chronos/integrity_validator_check_replay.py | 30 | |
| LOW | infra/chronos/integrity_validator_check_replay.py | 51 | |
| LOW | infra/chronos/integrity_validator_check_replay.py | 69 | |
| LOW | infra/chronos/integrity_validator_check_replay.py | 87 | |
| LOW | infra/chronos/integrity_validator_check_replay.py | 124 | |
| LOW | infra/chronos/integrity_validator_check_replay.py | 178 | |
| LOW | infra/chronos/integrity_validator_run_tests.py | 36 | |
| LOW | infra/chronos/integrity_validator_run_tests.py | 116 | |
| LOW | infra/chronos/integrity_validator_run_tests.py | 221 | |
| LOW | infra/chronos/coverage_test_collection.py | 38 | |
| LOW | infra/chronos/manager.py | 193 | |
| LOW | infra/experimental/agent-skills/helper.py | 975 | |
| LOW | infra/experimental/mcp/client.py | 422 | |
| LOW | infra/experimental/mcp/client.py | 946 | |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 186 | |
| LOW | infra/experimental/mcp/oss_fuzz_server.py | 544 | |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 192 | |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 575 | |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 768 | |
| LOW | infra/experimental/contrib/arvo/arvo_utils.py | 176 | |
| LOW | infra/experimental/contrib/arvo/arvo_utils.py | 612 | |
| LOW | infra/ci/check_base_os.py | 43 | |
| LOW | …base-images/base-runner/python_coverage_runner_help.py | 83 | |
| LOW | infra/base-images/base-runner/test_all.py | 70 | |
| LOW | …fra/base-images/base-builder/python_coverage_helper.py | 25 | |
| LOW | infra/base-images/base-builder/unshallow_repos.py | 25 | |
| LOW | infra/base-images/base-builder/detect_repo.py | 74 | |
| LOW | …lder/sanitizers/pysecsan/pysecsan/command_injection.py | 36 | |
| LOW | …fra/base-images/base-builder/indexer/manifest_types.py | 400 | |
| LOW | …fra/base-images/base-builder/indexer/manifest_types.py | 420 | |
| LOW | infra/base-images/base-builder/indexer/dwarf_info.py | 50 | |
| LOW | infra/base-images/base-builder/indexer/clang_wrapper.py | 322 | |
| LOW | …a/base-images/base-builder/indexer/index_build_test.py | 79 | |
| LOW | infra/base-images/base-builder/indexer/index_build.py | 164 | |
| LOW | infra/base-images/base-builder/indexer/index_build.py | 312 | |
| LOW | infra/base-images/base-builder/indexer/index_build.py | 729 | |
| LOW | infra/cifuzz/fuzz_target.py | 167 | |
| LOW | infra/cifuzz/config_utils.py | 241 | |
| LOW | infra/cifuzz/config_utils.py | 203 | |
| LOW | infra/cifuzz/config_utils.py | 335 | |
| LOW | projects/paramiko/fuzz_packetizer.py | 39 | |
| LOW | projects/ffmpeg/group_seed_corpus.py | 30 | |
| LOW | projects/ffmpeg/group_seed_corpus.py | 90 | |
| LOW | projects/pyrsistent/fuzz_vector.py | 23 | |
| LOW | projects/pyparsing/fuzz_parse.py | 30 | |
| LOW | projects/angle/gen_clones.py | 20 | |
| LOW | projects/multidict/fuzz_md.py | 23 | |
| LOW | projects/cirq/fuzz_circuit.py | 24 | |
| LOW | projects/kiwisolver/fuzz_solver.py | 27 | |
| LOW | …s/cloud-custodian/fuzz_gcp_filters_validate_process.py | 45 | |
| LOW | projects/cloud-custodian/fuzz_filters_validate.py | 35 | |
| 13 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | infra/experimental/agent-skills/helper.py | 1574 | # Single focused harness per project (no summary by default): |
| MEDIUM | infra/experimental/mcp/client.py | 117 | # Build fuzz harness. |
| LOW | …es/base-builder/sanitizers/pysecsan/pysecsan/sanlib.py | 155 | # Otherwise, just return attribute of instance |
| MEDIUM | infra/cifuzz/build_fuzzers.py | 14 | """Module used by CI tools in order to interact with fuzzers. This module helps |
| MEDIUM | projects/wolfssh/build.sh | 56 | # Build the fuzzer harness |
| MEDIUM | projects/postcss/build.sh | 36 | # Build Fuzzers. The harness lives upstream at test/fuzzing/fuzz_parse.js |
| MEDIUM | projects/tdengine/build.sh | 51 | # Compile the fuzzer harness |
| MEDIUM | projects/vlc/build.sh | 152 | # libFuzzer's ParseDictionaryFile rejects such lines, breaking the generic harness. |
| MEDIUM | projects/vlc/build.sh | 173 | # Write an options file to disable leak for the general harness |
| MEDIUM | projects/vlc/generate_seeds.py | 2352 | # The libfuzzer harness picks the demuxer module from the binary-name |
| MEDIUM | projects/vlc/generate_seeds.py | 2394 | # Round 2 — comprehensive event stream. The previous seeds covered only a |
| MEDIUM | projects/dcmtk/build.sh | 48 | # Derive robust link set from pkg-config and filter to installed libs. |
| MEDIUM | projects/qemu/replay_build.sh | 68 | # Skip generic harness. |
| MEDIUM | projects/rapidjson/build.sh | 30 | # Build fuzz harness. |
| MEDIUM | projects/wolftpm/build.sh | 52 | # Build the fuzz harness, linking wolftpm + wolfssl statically. |
| LOW | projects/esp-v2/build.sh | 141 | # TODO(nareddyt): just use the .tar directly when |
| MEDIUM | projects/imagemagick/run_tests.sh | 22 | # interface for comprehensive testing of ImageMagick. |
| MEDIUM | projects/wolfboot/build.sh | 55 | # Fold the two extra parser objects into libwolfboot.a so the harness |
| MEDIUM | projects/wolfboot/build.sh | 59 | # Harness compile/link. Each harness builds against the parser interface |
| Severity | File | Line | Snippet |
|---|---|---|---|
| HIGH | infra/repo_manager.py | 141 | Gets the list of commits(inclusive) between the old and new commits. Args: newest_commit: The newest commit t |
| HIGH | infra/utils.py | 56 | Runs a shell command in the specified directory location. Args: command: The command as a list to be run. env |
| HIGH | infra/bisector.py | 289 | From a commit range, this function caluclates which introduced a specific error from a fuzz testcase_path. Args: |
| HIGH | infra/base-images/base-builder/detect_repo.py | 157 | Runs a shell command in the specified directory location. Args: command: The command as a list to be run. loc |
| HIGH | …fra/base-images/base-builder/indexer/manifest_types.py | 597 | Helper function to parse environment variables from a list. Args: env_list: A list of environment variables in th |
| HIGH | infra/base-images/base-builder/indexer/dwarf_info.py | 128 | Parses the value of a `-frecord-command-line` entry from clang. Separate arguments within a command line are combine |
| HIGH | infra/cifuzz/fuzz_target.py | 285 | Checks if the testcase reproduces. Args: testcase: The path to the testcase to be tested. target_ |
| HIGH | infra/cifuzz/fuzz_target.py | 334 | Returns True if a crash is reportable. This means the crash is reproducible but not reproducible on a build from the |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | infra/chronos/integrity_validator_run_tests.py | 238 | # Check if there is a .git directory |
| LOW | infra/experimental/chronos/chronos.sh | 53 | # Check if any element in the command array contains the FUZZ_TARGET. |
| LOW | infra/experimental/agent-skills/copy_to_global.sh | 41 | # Check if the global skills directory exists, if not create it |
| LOW | …base-images/base-runner/python_coverage_runner_help.py | 59 | # Check if this file exists in our file paths: |
| LOW | …fra/base-images/base-builder/python_coverage_helper.py | 43 | # Check if .egg is in the path and if so we need to split it |
| LOW | infra/base-images/base-builder/detect_repo.py | 142 | # Check if valid git repo. |
| LOW | infra/base-images/base-builder/detect_repo.py | 146 | # Check if history fetch is needed. |
| LOW | infra/base-images/base-builder/detect_repo.py | 150 | # Check if commit is in history. |
| LOW | …lder/sanitizers/pysecsan/pysecsan/command_injection.py | 79 | # Check if the arguments are controlled by the fuzzer, and this given |
| LOW | …base-clang/checkout_build_install_llvm_ubuntu_20_04.sh | 20 | # Set this to get a full build with all binaries and libraries, as well as |
| LOW | …base-clang/checkout_build_install_llvm_ubuntu_24_04.sh | 20 | # Set this to get a full build with all binaries and libraries, as well as |
| LOW | …/base-images/base-clang/checkout_build_install_llvm.sh | 20 | # Set this to get a full build with all binaries and libraries, as well as |
| LOW | infra/cifuzz/config_utils.py | 119 | self.dry_run = _is_dry_run() # Check if failures should not be reported. |
| LOW | projects/lit/build.sh | 21 | # Check if the file contains the "type" field |
| LOW | projects/canvg/build.sh | 45 | # Check if the file contains the "type" field |
| LOW | projects/angular/build.sh | 21 | # Check if the file contains the "type" field |
| LOW | projects/angular/build.sh | 79 | # Check if the file has the "mjs" extension |
| LOW | projects/d3/build.sh | 21 | # Check if the file contains the "type" field |
| LOW | projects/libssh/build.sh | 58 | # Check if this fuzzer needs ssh_server_mock |
| LOW | projects/libssh/build.sh | 64 | # Check if this fuzzer needs ssh_client_mock |
| LOW | projects/bc-java/build.sh | 18 | # Set encoding to UTF-8 for Java compilation |
| LOW | projects/promise-polyfill/build.sh | 21 | # Check if the file contains the "type" field |
| LOW | projects/libcacard/build.sh | 62 | # Check if it runs at least in build image |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | infra/experimental/chronos/build_cache_local.sh | 30 | # Step 1: build the base image |
| LOW | infra/experimental/chronos/build_cache_local.sh | 35 | # Step 2: create a container where `compile` has run which enables ccaching |
| LOW | infra/experimental/chronos/build_cache_local.sh | 57 | # Step 3: save (commit, locally) the cached container as an image |
| LOW | infra/experimental/chronos/build_cache_local.sh | 67 | # Step 4: save the list of executables created from a vanilla build. This is |
| LOW | infra/experimental/chronos/build_cache_local.sh | 74 | # Step 5: Build with replay enabled, and validate the executables are the same |
| LOW | infra/experimental/chronos/build_cache_local.sh | 90 | # Step 6: Extract the newly build executables |
| LOW | infra/experimental/chronos/build_cache_local.sh | 102 | # Step 7: match executables from vanilla builds and replay builds. |
| LOW | infra/experimental/chronos/build_cache_local.sh | 118 | # Step 8: prepare Dockerfile for ccache |
| LOW | infra/experimental/chronos/build_cache_local.sh | 125 | # Step 9: Build an image with CCache's new items (modifications are done on the |
| LOW | infra/experimental/chronos/build_cache_local.sh | 131 | # Step 10: Run a `compile` with ccache's image. |
| LOW | infra/experimental/chronos/build_cache_local.sh | 145 | # Step 11: extract the executables from the ccache build |
| LOW | infra/experimental/chronos/build_cache_local.sh | 149 | # Step 12: validate the ccache builds are successful |
| LOW | infra/experimental/chronos/check_tests.sh | 32 | # Step 1: build the base image |
| LOW | infra/experimental/chronos/check_tests.sh | 36 | # Step 2: create a container where `compile` has run which enables ccaching |
| LOW | infra/experimental/chronos/check_tests.sh | 58 | # Step 3: save (commit, locally) the cached container as an image |
| LOW | infra/experimental/chronos/check_tests.sh | 62 | # Step 4: run the actual run_tests.sh script in the container. |
| LOW | infra/experimental/contrib/arvo/arvo_reproducer.py | 148 | # Step 1: Get the token from the cookie |
| LOW | projects/ruby/build.sh | 21 | # Step 1: Download and install latest stable Ruby release as baseruby |
| LOW | projects/ruby/build.sh | 58 | # Step 2: Build target Ruby from source with static linking |
| LOW | projects/ruby/build.sh | 119 | # Step 3: Set up paths for fuzzer builds |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | infra/pr_helper_test.py | 215 | 'primary_contact': 'user@example.com', |
| LOW | infra/pr_helper_test.py | 219 | self.assertTrue(pr_helper.is_known_contributor(content, 'user@example.com')) |
| LOW | infra/pr_helper_test.py | 225 | 'vendor_ccs': ['user@example.com'], |
| LOW | infra/pr_helper_test.py | 228 | self.assertTrue(pr_helper.is_known_contributor(content, 'user@example.com')) |
| LOW | infra/pr_helper_test.py | 235 | 'auto_ccs': ['user@example.com'] |
| LOW | infra/pr_helper_test.py | 237 | self.assertTrue(pr_helper.is_known_contributor(content, 'user@example.com')) |
| LOW | infra/pr_helper_test.py | 247 | 'user@example.com')) |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | infra/experimental/chronos/chronos.sh | 22 | # Usage: |
| LOW | infra/base-images/all.sh | 24 | # Usage: |
| LOW | projects/spirv-tools/generate_spirv_corpus.py | 26 | # Usage: |
| LOW | projects/vlc/generate_seeds.py | 32 | # Usage: |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | projects/github_scarecrow/fakelib.py | 19 | def do_something(data): |