* feat(filepath): add IsPathWithinAnyDirectory func
Signed-off-by: Dwi Siswanto <git@dw1.io>
* refactor: use path-aware filesystem containment checks
Several filesystem trust boundaries relied on
lexical prefix checks to decide whether a path
fell under an allowed directory. That let sibling
paths be treated as if they were children of
trusted directories.
Replace those checks with canonical path
containment checks for helper payload loading,
template archive extraction, custom template
metadata, template path classification, and
headless screenshot output validation.
Signed-off-by: Dwi Siswanto <git@dw1.io>
* adding more tests
* fixing tests
* adding test
---------
Signed-off-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
`ConnectSMBInfoMode` only tried SMBv1 when SMB2/3
negotiation failed so dual-stack servers could
report `SupportV1` as false even when SMBv1 was
enabled.
Run a same-target SMBv1 probe after successful
SMB2/3 negotiation and merge the support flag into
the returned log w/o changing the negotiated
SMB2/3 version.
Fixes#4832
Signed-off-by: Dwi Siswanto <git@dw1.io>
- Add TestParseNTLMResponse_Minimal48Bytes to explicitly cover the exact
lower boundary of the len<48 guard (minimal valid challenge, no target
name or info)
- Replace the inline immediately-invoked function for the wrong-message-type
case with a pre-built local variable for readability
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ParseNTLMResponse read fixed-header fields at offsets 12-14, 16-20, 40-42,
and 44-48 after only checking len>=12, causing a slice-bounds-out-of-range
panic for any NTLM section between 12 and 47 bytes. Because this input comes
from untrusted network data, a malicious or malformed telnet server could crash
the scanner (or the embedding host process when used via the SDK).
Raise the guard to len<48 so the full fixed header is present before any field
is touched. Add unit tests covering the happy path, existing error cases, and a
no-panic regression table for every truncated length in [12,47].
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Prevent pooled and non-pooled goja runtimes from
being reused or cleaned up when the `RunProgram`
goroutine fails to exit after context cancellation
and `Interrupt()`. In that state, the goroutine
may still be mutating runtime state, so touching
the runtime/returning it to the pool can cause
fatal concurrent map access panics.
Add an explicit `errRuntimeTerminationTimeout`
path that abandons the runtime, keeps the related
concurrency slot reserved, and releases that slot
only from a reaper after the orphaned goroutine
exits. Preserve `errors.Is` compatibility with the
original context cancellation cause.
Keep normal cleanup behavior unchanged, including
callback panic cleanup, and add regression tests
for stuck-interrupt handling that verify runtime
abandonment and delayed slot release.
Fixes#7376
* fix race condition
* fixing review comments
* fix(js): defer runtime cleanup
When a runtime is abandoned, we must not touch the
goja runtime after `RunProgram` has exceeded the
interrupt grace period. At the same time, cleanup
still needs to run on every normal exit before
returning the runtime to the pool, including setup
callback panics.
Signed-off-by: Dwi Siswanto <git@dw1.io>
---------
Signed-off-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Dwi Siswanto <git@dw1.io>
Bumps clistats, fastdialer, retryablehttp-go, dsl, networkpolicy,
ratelimit, sarif, utils, wappalyzergo, cdncheck. dsl v0.8.18 moves to
the projectdiscovery/govaluate fork, and utils v0.11.0 pulls aurora v4,
so the corresponding imports and type references are migrated.
Refs #7380.
The QueryAuthStrategy case in raw.Request.ApplyAuthStrategy parses
r.FullURL into a local 'parsed', appends auth params to parsed.Params,
then returns without writing back to r.FullURL. Every other branch in
the same switch mutates r.Headers, and the standalone QueryAuthStrategy
.Apply / .ApplyOnRR in pkg/authprovider/authx/query_auth.go both write
back to req.URL.RawQuery. Only the raw-request branch was missing the
write-back, so raw templates matching a 'query' auth secret silently
drop the auth params.
Adds r.FullURL = parsed.String() after the loop. New unit test fails
on dev and passes with the fix.
WithConfigFile/Bytes now decode YAML directly into a typed RuntimeConfig
struct and apply it via MergeOptions(opts). The goflags-backed reflection
overlay had too much surface area (266-line flag inventory duplicate plus
a flag-default vs DefaultOptions diff) for the actual SDK use case, which
is accepting a known set of scan knobs from cloud-shipped YAML.
RuntimeConfig schema covers tags/severity filtering, headers/vars,
interactsh, socks5-proxy, plus rate-limit/bulk-size/concurrency/timeout/
retries/rate-limit-host. Scalar knobs use *int so omitted keys preserve
the engine's existing value.
Drops internal/runner/flags.go (266 lines) and lib/config_load.go (86
lines). Reverts internal/runner/runner.go to dev (no SetupPDCPUpload
export; SDK inlines its own PDCP wrap). Keeps the LoadReportingOptionsFromBytes
extract in internal/runner/options.go for WithReportingConfigFile/Bytes.
The BindOptionFlags refactor of readConfig() caused duplicate group
headers in `nuclei -h` (CLI-only flags appended new same-named groups
after the shared ones). Suppressing the disabled-message on the CLI
was also a behavior change.
Both are scope creep. This PR is for SDK additions, not CLI refactor.
- Revert cmd/nuclei/main.go to dev. `nuclei -h` byte-identical.
- Restore "Scan results upload to cloud is disabled." in SetupPDCPUpload.
- flags.go stays for SDK-only use via lib/config_load.go.
SetupPDCPUpload returned a non-empty status string in the
upload-disabled branch, which displayExecutionInfo then logs as a
Warning on every nuclei run that doesn't request -dashboard. That
also suppresses the friendlier dashboard hint Info line.
Return empty for the default-disabled case so the Info hint fires.
The latent issue predates this PR; CodeRabbit surfaced it on the
refactor.
DisableUpdateCheck() mutates DefaultConfig process-globally. config_test.go
files run alphabetically before sdk_test.go, so my tests were disabling the
update-check globally and TestContextCancelNucleiEngine (which depends on
template auto-install) was hitting an empty template store on first run.
Drop the option from the seven test sites. First test in the binary now
triggers template install (sync.Once gated; subsequent tests free).
client-go v1.x widened ID fields from int to int64 across the API surface
(User.ID, Issue.ID, ListOptions.Page/PerPage). Adjust the tracker to the
new signatures: Integration.userID, the assignee slice, the FormatInt
arguments, and ListOptions casts.
Keep Options.DuplicateIssuePageSize / DuplicateIssueMaxPages as int —
that struct is user-facing YAML and YAML ints round-trip into int64 fine.
Cast at the call site only.
UpdateIssue and CreateIssueNote signatures also widened, but issue.IID
is already int64 in v1.x, so existing call sites compile unchanged.
Extracted into flags.go from cmd/nuclei/main.go but the trailing
//nolint:all was dropped — golangci-lint trips on SA1019 in the
SDK-shared path. Restoring matches the dev branch line.
- L1: sdk_private.go references SetupPDCPUpload (was lowercase).
- L2: config_test.go test comment describes how tmpEngine is constructed
rather than incorrectly claiming "inherits from parent".
- Trim godocs and inline comments across the PR — drop restated WHAT,
keep WHY and limitations.
- Inline (*Runner).setupPDCPUpload — wrapper just delegated to the
package-level SetupPDCPUpload. Call site inlines the three lines.
- Dedupe reporting-config file load: WithReportingConfigFile and
loadImplicitReportingConfig share loadReportingConfigFromPath.
- Move config-overlay/load helpers (newConfigFlagSet, overlayConfigFromFile,
applyOverlay, loadReportingConfigFromPath, loadImplicitReportingConfig)
out of lib/config.go into lib/config_load.go.
- Drop threadSafePerScan engine mode and isThreadSafe helper. The four
new With* options no longer gate per-scan use. pd-agent doesn't enter
thread-safe mode; reintroducing the gate ships as a follow-up PR with
its own scope.
`FindExpressions` checks marker contents with
govaluate before doing normal placeholder
replacement. That breaks valid hyphenated names
like `request-id`: govaluate reads them as
subtraction lol, and the lookup fails with a
missing request parameter.
If a marker exactly matches a key in the
replacement map, treat it as a plain placeholder
and let normal replacement handle it. Authored
expressions should still be evaluated, and
malformed helper calls should still return errors.
Fixes#7395
Signed-off-by: Dwi Siswanto <git@dw1.io>
SDK consumers had to rebuild types.Options by hand or shell out to the
CLI to get config-file parity. This shares BindOptionFlags,
LoadReportingOptionsFromBytes, ApplyExporterOptionsFromTypes, and
SetupPDCPUpload between cmd/nuclei and lib/ so both paths produce
identical engine state.
WithConfigFile/Bytes apply only YAML-set fields (reflection diff against
goflags defaults) so prior With* and DefaultOptions() values survive
YAML that omits them. Per-scan ExecuteNucleiWithOpts rejects these
options via a new threadSafePerScan mode, matching the pattern for
options that only make sense at construction.
dependabot[bot]