fuzz-introspector on java projects

[eaubin]

Is fuzz-introspector expected to work on java projects? Running oss-fuzz introspector on json-sanitizer and zookeeper locally failed, and many (all?) of the java projects on https://introspector.oss-fuzz.com/ are missing introspector data.

[DavidKorczynski]

@arthurscchan can you assist here?

Yes, it's working for java. Some recent sample reports:

• https://storage.googleapis.com/oss-fuzz-introspector/checkstyle/inspector-report/20250128/fuzz_report.html
• https://storage.googleapis.com/oss-fuzz-introspector/cglib/inspector-report/20250128/fuzz_report.html
• https://storage.googleapis.com/oss-fuzz-introspector/jopt-simple/inspector-report/20250128/fuzz_report.html

I think there may be some java projects in oss-fuzz that are not super well-maintained, but I think @arthurscchan was looking to fix a bunch of build scripts to fix some of these issues.

FI has also been used in combination of OSS-Fuzz and OSS-Fuzz-gen: https://blog.oss-fuzz.com/posts/introducing-java-auto-harnessing/

[DavidKorczynski]

@eaubin following your comment we found a regression in the java OSS-Fuzz integration. It's being fixed here google/oss-fuzz#13037 and we're also pushing some other changes e.g. google/oss-fuzz#13039 which should solve some issues with Fuzz Introspector in some java projects in OSS-Fuzz.

In the following days you should see a lot of improvements across the java projects on https://introspector.oss-fuzz.com