V8 Script Collection

A script collection for collecting, analyzing, and processing vulnerability fix commits from the Google V8 JavaScript engine. This project focuses on extracting security-related commits from the V8 repository, obtaining corresponding reward information, and performing similarity analysis.

🚀 Features

• Automated Commit Collection: Automatically collect vulnerability fix-related commits from V8 Git mirror repository
• Reward Information Scraping: Extract vulnerability reward information from Chromium security blog and issue tracker for commits collected from V8 Git mirror repository
• Intelligent Filtering: Filter commits with reward information based on code change scale, file types, and other conditions
• Similarity Analysis: Analyze similarities between commits using AI and vector embedding techniques
• Data Analysis: Generate detailed statistical reports and visualization analysis

📁 Project Structure

v8-script/
├── scripts/                   # Core scripts directory
│   ├── collect_v8_commits.py     # V8 commit collection script
│   ├── chromeblog_crawl.py       # Chrome security blog crawler
│   ├── reward_collector_from_commits.py  # Reward information collector
│   ├── reward_filter.py          # Commit filter
│   ├── similarity.py             # Similarity analysis script
│   └── analyze.py                # Data analysis script
├── commits/                   # Data files directory
│   ├── rewards_rewarded.json        # Complete reward data
│   ├── rewards_filtered.json     # Filtered data
│   ├── commits_no_access.json    # Commits with no access permission
│   └── blog_commits_rewarded_2017_2025.csv  # Blog reward data
├── embeddings/               # Vector embedding storage directory
└── rawdata/                 # Raw data directory
    └── patch_descriptions/   # Patch description files

🛠️ Environment Requirements

External Dependencies

• Git: For accessing V8 repository
• OpenAI API Key: For AI-driven similarity analysis
• Playwright: For web scraping functionality

⚙️ Configuration

1. Set OpenAI API Key

export OPENAI_API_KEY="your-api-key-here"

Or configure directly in the script:

os.environ["OPENAI_API_KEY"] = "your-api-key-here"

2. Clone V8 Mirror Repository

git clone https://github.com/v8/v8.git

📖 Usage Guide

1. Collect V8 Commits

Collect vulnerability fix-related commits from V8 mirror repository:

cd scripts/
python collect_v8_commits.py collect ../commits/v8_commits.csv

Features:

• Analyze commit messages to identify vulnerability fix keywords
• Extract bug links and issue IDs
• Automatically classify vulnerability types (Use-After-Free, Out-of-bound, etc.)

2. Crawl Chrome Security Blog

Get historical reward data from official security blog:

python chromeblog_crawl.py

Output: chromium_security_fixes_2017_2025.csv

3. Collect Reward Information

Get corresponding reward information based on commit data:

python reward_collector_from_commits.py ../commits/v8_commits.csv ../commits/rewards.json

Features:

• Automatically access Chromium issue tracker
• Extract VRP (Vulnerability Reward Program) reward amounts
• Handle access permission restricted issues

4. Filter Commits

Filter commits based on code change scale:

python reward_filter.py ../commits/rewards_rewarded.json ../commits/rewards_filtered.json

Filter Conditions:

• Contains .cc or .cpp files
• Number of modified files ≤ 10
• Code line changes ≤ 100
• Number of modified methods 1-10

5. Similarity Analysis

Analyze similarities between commits using AI technology:

python similarity.py

Features:

• Use OpenAI GPT model to generate patch descriptions
• Create vector embeddings for similarity calculation
• Identify similar commit groups
• Detect duplicate issue IDs

6. Data Analysis

Generate detailed statistical reports:

python analyze.py

Output Content:

• Basic statistics (total commits, total rewards, etc.)
• Reward distribution
• Top contributor rankings
• Vulnerability type statistics

📊 Data Format

Commit Data Format (JSON)

{
  "commit_hash": {
    "summary": "Commit summary",
    "author": "Author name",
    "bug_type": "Vulnerability type",
    "issue_link": "Issue link",
    "reward": "Reward amount",
    "issue_id": "Issue ID"
  }
}

Similarity Analysis Results

Similar Group 0
===============
Average Similarity: 0.9500
Number of Commits: 5

Commits in this group:
1. Commit: abc123def456
   Bug Type: Use-After-Free
   Issue ID: 123456
   Similarity Score: 0.9800

🔍 Vulnerability Type Classification

The scripts automatically identify the following vulnerability types:

• Use-After-Free: Use after free vulnerabilities
• Null-Ptr-Deref: Null pointer dereference
• Out-of-bound: Out of bounds access
• Double-free: Double free
• Memory-Leak: Memory leak
• Integer-Flow: Integer overflow/underflow
• Lock-Misuse: Lock misuse
• Signedness-Bug: Signedness bugs
• UnKnown: Unknown type

📈 Statistics Example

Typical output after running the analysis script:

🚀 V8 COMMIT REWARDS ANALYSIS REPORT
=====================================

📊 1. BASIC STATISTICS:
   • Total Commits: 1,234
   • Total Rewards: $2,345,678
   • Average Reward: $1,901.23
   • Highest Reward: $62,000
   • Lowest Reward: $1,000

💰 2. REWARD DISTRIBUTION:
   • 5,000 - 7,999: 456 commits (37.02%)
   • 8,000 - 10,999: 234 commits (18.97%)
   • 11,000 - 20,000: 345 commits (27.95%)

👥 3. TOP AUTHORS (by total rewards):
   #1 Samuel Groß: 45 commits, Total: $245,000, Avg: $5,444
   #2 Marja Hölttä: 38 commits, Total: $198,000, Avg: $5,211

🔗 Related Links

• V8 JavaScript Engine
• Chrome Releases Blog
• Chromium Bug Tracker