[vitali87]

Summary

• First part of a cargo-fuzz package for rust/cgr_graph_rs. src/lib.rs is the shared input decoder, total over every byte string, and require!, which aborts when a property is false.
• cypher_parse: the lexer's tokens cover the query in order, and each span holds what its kind says. Lexer errors and deferrals point at the character that caused them. parse returns the lexer's error unchanged, and otherwise only grammar errors within the query.
• json_string: push_string writes printable ASCII that a JSON parser reads back to the same string, with exactly the escapes json.dumps writes (lowercase hex, surrogate pairs above the BMP).
• The package's Cargo.toml comes last in this stack, so nothing builds a partial package.

Demo

No user-visible change: fuzz targets only. Nothing in the package, CI or the wheel builds rust/cgr_graph_rs/fuzz.

Type of Change

• CI/CD or tooling

Related Issues

None.

Test plan

Run on the whole stack, since the package builds once its manifest lands in the last PR:

• Red: each property in these targets goes red under a one-line change to the library. The property's comment names the change and the input that aborts; each was run against the mutated library, and the property it documents is the one that fired.
• Green: the unmutated library runs each target with no abort, for 10 minutes from the seed corpus after the shorter runs that built it.
• Negative tests: every check here is a negative test by construction. It aborts on output the library must not produce, and its mutant shows the abort happens.
• Coverage: a minimized seed corpus runs every API call and every property check in each target (cargo fuzz coverage).
• cargo +nightly-2025-07-16 check --bins passes, as well as the current nightly.

Files changed

• rust/cgr_graph_rs/fuzz/.gitignore
• rust/cgr_graph_rs/fuzz/src/lib.rs
• rust/cgr_graph_rs/fuzz/fuzz_targets/json_string.rs
• rust/cgr_graph_rs/fuzz/fuzz_targets/cypher_parse.rs

Diff stats

+398 additions, -0 deletions (398 LOC)

Dependency graph

Merge in this order:

pr-1: test(graph-rs): add the fuzz input decoder and the Cypher and JSON fuzz targets  <-- this PR
└── pr-2: test(graph-rs): add the graph procedures fuzz target
    └── pr-3: test(graph-rs): add the bulk writer and walk fuzz target
        └── pr-4: test(graph-rs): add the fuzz package manifest

Summary by CodeRabbit

• Tests
  • Added fuzz testing for Cypher parsing and JSON string escaping, checking that malformed input is handled safely and valid output preserves its content.
  • Expanded randomized input coverage for text, numbers, and other values, with checks for token boundaries, error locations, and formatted syntax errors.
  • Added exclusions for generated fuzzing files so they do not clutter the repository.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T23:17:33.093628Z	7a81711	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: vitali87/code-graph-rag
• Branch: pr-split/claude-cgr-graph-rs-fuzz/pr-1
• File: .coderabbit.yaml
• Commit: cf1d4e3
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Advanced
• Run ID: 0de32b1b-0dbc-46ff-b8d1-da71c404c4ec

Commits

Reviewing files that changed from the base of the PR and between 7a81711 and cf1d4e3.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: vitali87/code-graph-rag
• Branch: pr-split/claude-cgr-graph-rs-fuzz/pr-1
• File: .coderabbit.yaml
• Commit: 7a81711
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Advanced
• Run ID: 9f1eb2e7-16c6-4317-a0f1-26a7059767b6

Commits

Reviewing files that changed from the base of the PR and between 0db39cb and 7a81711.

Files selected for processing: 4

• rust/cgr_graph_rs/fuzz/.gitignore
• rust/cgr_graph_rs/fuzz/fuzz_targets/cypher_parse.rs
• rust/cgr_graph_rs/fuzz/fuzz_targets/json_string.rs
• rust/cgr_graph_rs/fuzz/src/lib.rs

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 3 remain after this review.

Walkthrough

The Rust fuzz package adds shared input utilities and fuzz targets for Cypher parsing and JSON string encoding. The targets check parser and lexer invariants, as well as JSON string output and decoding properties.

Changes: Rust fuzz package

Layer / File(s)	Summary
Shared fuzz input support rust/cgr_graph_rs/fuzz/src/lib.rs, rust/cgr_graph_rs/fuzz/.gitignore	Adds the require! macro and Input methods for reading and decoding fuzz input. Adds ignore rules for generated fuzz data.
Cypher lexing and parsing checks rust/cgr_graph_rs/fuzz/fuzz_targets/cypher_parse.rs	Adds checks for lexer and parser errors, token spans and values, and error positions.
JSON string encoding checks rust/cgr_graph_rs/fuzz/fuzz_targets/json_string.rs	Adds checks for output prefix preservation, printable-ASCII output, and canonical escape decoding.

Priority: Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Possibly related PRs

• vitali87/code-graph-rag#3445: Adds the fuzz package manifest and declares the binaries implemented by these targets.

Merge Risk: Minimal · up to 7a817

No actionable issue remains in this PR’s fuzz targets; the change is ready to merge after normal checks.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly identifies the shared fuzz input decoder and the Cypher and JSON fuzz targets. It is concise, specific, and related to the main changes.
Description check		The description provides a clear summary, explains the lack of user-visible changes, identifies the change type, states related issues, and gives detailed test results. The checklist section from the …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description provides a clear summary, explains the lack of user-visible changes, identifies the change type, states related issues, and gives detailed test results. The checklist section from the template is missing, but the description is otherwise complete.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Low impact] Appears safe to merge in the stated stack order, with PR #3445 supplying the fuzz package manifest.

Summary

Adds shared fuzz input helpers and targets for Cypher parsing and JSON string escaping.

• Cypher fuzz runs check how queries are tokenized and parsed.
• JSON string fuzz runs check how strings are written.
• Fuzz targets share input tools and ignore generated files.

_{Reviews (1) · Last reviewed commit: "test(graph-rs): add the fuzz input decod..." · Reviewed by Greptile}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud