admin/projectdiscovery-nuclei
1
0
Fork 0
mirror of https://github.com/projectdiscovery/nuclei synced 2026-06-08 16:50:47 +00:00
Code Issues Packages Projects Releases Wiki Activity
6,344 Commits 66 Branches 143 Tags
dev
Commit Graph

19 Commits

Author SHA1 Message Date
Dwi Siswanto 20cbf0bd73 refactor: use path-aware filesystem containment checks (#7420) 
* feat(filepath): add IsPathWithinAnyDirectory func

Signed-off-by: Dwi Siswanto <git@dw1.io>

* refactor: use path-aware filesystem containment checks

Several filesystem trust boundaries relied on
lexical prefix checks to decide whether a path
fell under an allowed directory. That let sibling
paths be treated as if they were children of
trusted directories.

Replace those checks with canonical path
containment checks for helper payload loading,
template archive extraction, custom template
metadata, template path classification, and
headless screenshot output validation.

Signed-off-by: Dwi Siswanto <git@dw1.io>

* adding more tests

* fixing tests

* adding test

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
 2026-06-04 21:03:51 +05:30
Dwi Siswanto f893b6c0cb refactor: native tests (#7307) 
Signed-off-by: Dwi Siswanto <git@dw1.io>
 2026-04-15 05:27:07 +07:00
Mzack9999 fde6f72934 refactor 2025-09-12 19:03:56 +02:00
Mzack9999 99a9ce398d Merge branch 'dev' into pr/6422 2025-09-12 18:25:18 +02:00
zy9ard3 1f0aef970c fix for error.Is false return 2025-08-26 10:48:10 +05:30
zy9ard3 5b7debf349 Update pkg/external/customtemplates/github.go 
Co-authored-by: Dwi Siswanto <25837540+dwisiswant0@users.noreply.github.com>
 2025-08-26 09:05:31 +05:30
Tarun Koyalwar 19247ae74b Path-Based Fuzzing SQL fix (#6400) 
* setup claude

* migrate to using errkit

* fix unused imports + lint errors

* update settings.json

* fix url encoding issue

* fix lint error

* fix the path fuzzing component

* fix lint error
 2025-08-25 13:36:58 +05:30
zy9ard3 5be258f948 no changes custom template message should be INF not ERR 2025-08-25 01:15:56 +05:30
Sandeep Singh b4644af80a Lint + test fixes after utils dep update (#6393) 
* fix: remove undefined errorutil.ShowStackTrace

* feat: add make lint support and integrate with test

* refactor: migrate errorutil to errkit across codebase

- Replace deprecated errorutil with modern errkit
- Convert error declarations from var to func for better compatibility
- Fix all SA1019 deprecation warnings
- Maintain error chain support and stack traces

* fix: improve DNS test reliability using Google DNS

- Configure test to use Google DNS (8.8.8.8) for stability
- Fix nil pointer issue in DNS client initialization
- Keep production defaults unchanged

* fixing logic

* removing unwanted branches in makefile

---------

Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
 2025-08-20 05:28:23 +05:30
HD Moore 5b89811b90 Support concurrent Nuclei engines in the same process (#6322) 
* support for concurrent nuclei engines

* clarify LfaAllowed race

* remove unused mutex

* update LfaAllowed logic to prevent races until it can be reworked for per-execution ID

* Update pkg/templates/parser.go

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* debug tests

* debug gh action

* fixig gh template test

* using atomic

* using synclockmap

* restore tests concurrency

* lint

* wiring executionId in js fs

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
 2025-07-19 00:10:58 +05:30
Dwi Siswanto 87ed0b2bb9 build: bump all direct modules (#6290) 
* chore: fix non-constant fmt string in call

Signed-off-by: Dwi Siswanto <git@dw1.io>

* build: bump all direct modules

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore(hosterrorscache): update import path

Signed-off-by: Dwi Siswanto <git@dw1.io>

* fix(charts): break changes

Signed-off-by: Dwi Siswanto <git@dw1.io>

* build: pinned `github.com/zmap/zcrypto` to v0.0.0-20240512203510-0fef58d9a9db

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore: golangci-lint auto fixes

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore: satisfy lints

Signed-off-by: Dwi Siswanto <git@dw1.io>

* build: migrate `github.com/xanzy/go-gitlab` => `gitlab.com/gitlab-org/api/client-go`

Signed-off-by: Dwi Siswanto <git@dw1.io>

* feat(json): update build constraints

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore: dont panicking on close err

Signed-off-by: Dwi Siswanto <git@dw1.io>

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
 2025-07-01 00:40:44 +07:00
alban.stourbe stourbe e35c6049bb Add loadConfig S3 based on AWS_PROFILE ~/.aws/credentials 2025-03-24 17:17:14 +01:00
Sandeep Singh 156b22687b utils version update (#5917) 
* utils update

* use test tempdir

* skip custom tm tests on macos

---------

Co-authored-by: Tarun Koyalwar <tarun@projectdiscovery.io>
 2024-12-17 18:26:15 +05:30
Dwi Siswanto 13af7ccd49 fix: data race at protocolstate, contextargs & some outdated test cases (#5820) 
* test(flow): update outdated test cases

Signed-off-by: Dwi Siswanto <git@dw1.io>

* test(multiproto): update outdated test cases

Signed-off-by: Dwi Siswanto <git@dw1.io>

* feat: fixed failing tests

* fixed data race

* fixed memgaurdian race conditiong

* test(customtemplates): use test repo

Signed-off-by: Dwi Siswanto <git@dw1.io>

* feat(customtemplates): add more `{Clone,Pull}Options`

Signed-off-by: Dwi Siswanto <git@dw1.io>

* feat(customtemplates): validate `{Clone,Pull}Options`

Signed-off-by: Dwi Siswanto <git@dw1.io>

* bugfix: fixed failing integration tests for flow and multi

* chore: either 1 or 2 results in interactsh

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Ice3man <nizamulrana@gmail.com>
 2024-11-19 11:08:25 +05:30
mzack9999 bfdc507c6c lint 2024-08-21 16:34:53 +02:00
debasishbsw 1700cdf4e2 update go-git fix CVE-2023-49569 CVE-2023-49568 
Signed-off-by: debasishbsw <debasishbsws.dev@gmail.com>
 2024-03-14 10:26:08 +00:00
Tarun Koyalwar 87aeb57b0d feat nuclei result upload (#4343) 
* feat: add pdcp api key support

* add '-auth' cli option

* fix creds test

* results auto upload to pdcp

* fix upload on empty file

* dashboard env + fix test

* purge old cloud cli options

* misc updates in runner package

* fix headless integration test

* misc update

* add disable cloud upload env

---------

Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
 2023-11-18 16:25:37 +05:30
Dogan Can Bakir 1d0fbc0b62 restructure repo dir (#4293) 
* restructure repo dir

* fix path in test
 2023-10-30 21:00:51 +05:30
Tarun Koyalwar dc44105baf nuclei v3 : misc updates (#4247) 
* use parsed options while signing

* update project layout to v3

* fix .gitignore

* remove example template

* misc updates

* bump tlsx version

* hide template sig warning with env

* js: retain value while using log

* fix nil pointer derefernce

* misc doc update

---------

Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
 2023-10-17 17:44:13 +05:30