Fuzz introspector: JWTFuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
29 32 [com.auth0.jwt.impl.JWTParser].addDeserializers(com.fasterxml.jackson.databind.ObjectMapper) call site: 00032 [com.auth0.jwt.TokenUtils].splitToken(String)
9 2 [com.example.JWTFuzzer].myFuzzTest(com.code_intelligence.jazzer.api.FuzzedDataProvider) call site: 00002 [com.auth0.jwt.algorithms.HMACAlgorithm].getSecretBytes(String)
6 70 [com.auth0.jwt.JWTVerifier].verifyAlgorithm(com.auth0.jwt.interfaces.DecodedJWT,com.auth0.jwt.algorithms.Algorithm) call site: 00070 [com.auth0.jwt.JWTVerifier].verifyClaims(com.auth0.jwt.interfaces.DecodedJWT,List )
3 17 [com.example.JWTFuzzer].myFuzzTest(com.code_intelligence.jazzer.api.FuzzedDataProvider) call site: 00017 [com.auth0.jwt.impl.JWTParser].createDefaultObjectMapper()
1 12 [com.example.JWTFuzzer].myFuzzTest(com.code_intelligence.jazzer.api.FuzzedDataProvider) call site: 00012
1 14 [com.example.JWTFuzzer].myFuzzTest(com.code_intelligence.jazzer.api.FuzzedDataProvider) call site: 00014
1 65 [com.example.JWTFuzzer].myFuzzTest(com.code_intelligence.jazzer.api.FuzzedDataProvider) call site: 00065 [com.auth0.jwt.JWTVerifier].verifyAlgorithm(com.auth0.jwt.interfaces.DecodedJWT,com.auth0.jwt.algorithms.Algorithm)

Fuzzer calltree

0 [com.example.JWTFuzzer].myFuzzTest(com.code_intelligence.jazzer.api.FuzzedDataProvider) [function] [call site] 00000
1 [com.code_intelligence.jazzer.api.FuzzedDataProvider].consumeString(int) [function] [call site] 00001
1 [com.auth0.jwt.algorithms.Algorithm].HMAC256(String) [function] [call site] 00002
2 [com.auth0.jwt.algorithms.HMACAlgorithm].<init>(String,String,String) [function] [call site] 00003
3 [com.auth0.jwt.algorithms.CryptoHelper].<init>() [function] [call site] 00004
3 [com.auth0.jwt.algorithms.HMACAlgorithm].getSecretBytes(String) [function] [call site] 00005
4 [IllegalArgumentException].<init>(String) [function] [call site] 00006
4 [String].getBytes(com.auth0.jwt.algorithms.HMACAlgorithm) [function] [call site] 00007
3 [com.auth0.jwt.algorithms.HMACAlgorithm].<init>(com.auth0.jwt.algorithms.CryptoHelper,String,String,byte[]) [function] [call site] 00008
4 [com.auth0.jwt.algorithms.Algorithm].<init>(String,String) [function] [call site] 00009
4 [IllegalArgumentException].<init>(String) [function] [call site] 00010
4 [java.util.Arrays].copyOf(byte[],com.auth0.jwt.algorithms.HMACAlgorithm) [function] [call site] 00011
1 [com.auth0.jwt.algorithms.Algorithm].HMAC384(String) [function] [call site] 00012
2 [com.auth0.jwt.algorithms.HMACAlgorithm].<init>(String,String,String) [function] [call site] 00013
1 [com.auth0.jwt.algorithms.Algorithm].HMAC512(String) [function] [call site] 00014
2 [com.auth0.jwt.algorithms.HMACAlgorithm].<init>(String,String,String) [function] [call site] 00015
1 [com.code_intelligence.jazzer.api.FuzzedDataProvider].consumeRemainingAsString() [function] [call site] 00016
1 [com.auth0.jwt.JWT].decode(String) [function] [call site] 00017
2 [com.auth0.jwt.JWTDecoder].<init>(String) [function] [call site] 00018
3 [com.auth0.jwt.impl.JWTParser].<init>() [function] [call site] 00019
4 [com.auth0.jwt.impl.JWTParser].createDefaultObjectMapper() [function] [call site] 00020
5 [com.fasterxml.jackson.databind.ObjectMapper].<init>() [function] [call site] 00021
5 [com.fasterxml.jackson.databind.ObjectMapper].disable(com.auth0.jwt.impl.JWTParser) [function] [call site] 00022
5 [com.fasterxml.jackson.databind.ObjectMapper].setSerializationInclusion(com.auth0.jwt.impl.JWTParser) [function] [call site] 00023
5 [com.auth0.jwt.impl.JWTParser].addDeserializers(com.fasterxml.jackson.databind.ObjectMapper) [function] [call site] 00024
6 [com.fasterxml.jackson.databind.module.SimpleModule].<init>() [function] [call site] 00025
6 [com.auth0.jwt.impl.PayloadDeserializer].<init>() [function] [call site] 00026
7 [Object].<init>() [function] [call site] 00027
6 [com.fasterxml.jackson.databind.module.SimpleModule].addDeserializer(com.auth0.jwt.impl.PayloadDeserializer) [function] [call site] 00028
6 [com.auth0.jwt.impl.HeaderDeserializer].<init>() [function] [call site] 00029
7 [Object].<init>() [function] [call site] 00030
6 [com.fasterxml.jackson.databind.module.SimpleModule].addDeserializer(com.auth0.jwt.impl.HeaderDeserializer) [function] [call site] 00031
6 [com.fasterxml.jackson.databind.ObjectMapper].registerModule(com.fasterxml.jackson.databind.module.SimpleModule) [function] [call site] 00032
4 [com.fasterxml.jackson.databind.ObjectMapper].readerFor() [function] [call site] 00033
4 [com.fasterxml.jackson.databind.ObjectMapper].readerFor() [function] [call site] 00034
3 [com.auth0.jwt.JWTDecoder].<init>(com.auth0.jwt.impl.JWTParser,String) [function] [call site] 00035
4 [com.auth0.jwt.TokenUtils].splitToken(String) [function] [call site] 00036
5 [com.auth0.jwt.exceptions.JWTDecodeException].<init>(String) [function] [call site] 00037
6 [com.auth0.jwt.exceptions.JWTDecodeException].<init>(String,null) [function] [call site] 00038
5 [String].indexOf(com.auth0.jwt.TokenUtils) [function] [call site] 00039
5 [com.auth0.jwt.TokenUtils].wrongNumberOfParts(int) [function] [call site] 00040
5 [String].indexOf(com.auth0.jwt.TokenUtils,int) [function] [call site] 00041
5 [com.auth0.jwt.TokenUtils].wrongNumberOfParts(int) [function] [call site] 00042
5 [String].indexOf(com.auth0.jwt.TokenUtils,int) [function] [call site] 00043
5 [com.auth0.jwt.TokenUtils].wrongNumberOfParts(String) [function] [call site] 00044
5 [String].substring(int,com.auth0.jwt.TokenUtils) [function] [call site] 00045
5 [String].substring(int,com.auth0.jwt.TokenUtils) [function] [call site] 00046
5 [String].substring(int) [function] [call site] 00047
4 [String].<init>(com.auth0.jwt.JWTDecoder,com.auth0.jwt.JWTDecoder) [function] [call site] 00048
4 [String].<init>(com.auth0.jwt.JWTDecoder,com.auth0.jwt.JWTDecoder) [function] [call site] 00049
4 [com.auth0.jwt.exceptions.JWTDecodeException].<init>(String,com.auth0.jwt.JWTDecoder) [function] [call site] 00050
4 [com.auth0.jwt.exceptions.JWTDecodeException].<init>(String,com.auth0.jwt.JWTDecoder) [function] [call site] 00051
4 [com.auth0.jwt.impl.JWTParser].parseHeader(String) [function] [call site] 00052
5 [com.auth0.jwt.impl.JWTParser].decodeException() [function] [call site] 00053
6 [com.auth0.jwt.impl.JWTParser].decodeException(null) [function] [call site] 00054
5 [com.fasterxml.jackson.databind.ObjectReader].readValue(String) [function] [call site] 00055
5 [com.auth0.jwt.impl.JWTParser].decodeException(String) [function] [call site] 00056
6 [com.auth0.jwt.exceptions.JWTDecodeException].<init>(com.auth0.jwt.impl.JWTParser) [function] [call site] 00057
4 [com.auth0.jwt.impl.JWTParser].parsePayload(String) [function] [call site] 00058
5 [com.auth0.jwt.impl.JWTParser].decodeException() [function] [call site] 00059
5 [com.fasterxml.jackson.databind.ObjectReader].readValue(String) [function] [call site] 00060
5 [com.auth0.jwt.impl.JWTParser].decodeException(String) [function] [call site] 00061
1 [com.code_intelligence.jazzer.api.FuzzedDataProvider].pickValue(com.example.JWTFuzzer) [function] [call site] 00062
1 [com.auth0.jwt.JWT].require() [function] [call site] 00063
1 [com.auth0.jwt.interfaces.Verification].build() [function] [call site] 00064
1 [com.auth0.jwt.JWTVerifier].verify(com.auth0.jwt.interfaces.DecodedJWT) [function] [call site] 00065
2 [com.auth0.jwt.JWTVerifier].verifyAlgorithm(com.auth0.jwt.interfaces.DecodedJWT,com.auth0.jwt.algorithms.Algorithm) [function] [call site] 00066
3 [com.auth0.jwt.algorithms.Algorithm].getName() [function] [call site] 00067
3 [com.auth0.jwt.interfaces.DecodedJWT].getAlgorithm() [function] [call site] 00068
3 [String].equals(com.auth0.jwt.JWTVerifier) [function] [call site] 00069
3 [com.auth0.jwt.exceptions.AlgorithmMismatchException].<init>(String) [function] [call site] 00070
4 [com.auth0.jwt.exceptions.JWTVerificationException].<init>(String) [function] [call site] 00071
5 [com.auth0.jwt.exceptions.JWTVerificationException].<init>(String,null) [function] [call site] 00072
2 [com.auth0.jwt.algorithms.Algorithm].verify(com.auth0.jwt.interfaces.DecodedJWT) [function] [call site] 00073
2 [com.auth0.jwt.JWTVerifier].verifyClaims(com.auth0.jwt.interfaces.DecodedJWT,List<com.auth0.jwt.impl.ExpectedCheckHolder>) [function] [call site] 00074
3 [com.auth0.jwt.interfaces.DecodedJWT].getClaim(com.auth0.jwt.JWTVerifier) [function] [call site] 00075
3 [com.auth0.jwt.exceptions.IncorrectClaimException].<init>(com.auth0.jwt.JWTVerifier,com.auth0.jwt.JWTVerifier,com.auth0.jwt.JWTVerifier) [function] [call site] 00076