15 Commits

Author SHA1 Message Date
Mzack9999 3537030e1f fix(js): watchdog + propagates context to all JS library network calls (#7299)
* fix(js): prevent pool slot starvation under load

Zombie goroutines from timed-out JS executions held pool slots
indefinitely: Add() blocked with context.Background(), and defer Done()
only ran when the goroutine eventually completed. Under load, both
pools (80 pooled + 20 non-pooled slots) filled with zombies, silently
dropping all subsequent matches.

Three changes fix slot lifecycle management:

1. Propagate the 20s deadline context into ExecuteProgram (compiler.go)
   so both execution paths can respect the deadline.

2. Replace Add() with AddWithContext(ctx) in both pool.go and
   non-pool.go so goroutines waiting for a slot fail fast when the
   deadline expires instead of blocking indefinitely.

3. Add a watchdog goroutine that releases the slot when the deadline
   expires, even if the zombie is still running. An atomic.Bool
   ensures exactly one Done() call between the watchdog and the
   normal defer path.

* adding context

* refactor(js): derived the ctx to remaining tractable deadline leaks (#7302)

* refactor(js): use `context.Background` as default instead

Signed-off-by: Dwi Siswanto <git@dw1.io>

* refactor(js): derived the ctx to remaining tractable deadline leaks

Signed-off-by: Dwi Siswanto <git@dw1.io>

* test(js): add `NucleiJS.Context` tests

Signed-off-by: Dwi Siswanto <git@dw1.io>

* fix(cmd): context param exclusion in memoization hash

The memoization template condition for excluding
context parameters from hash keys was incorrect.
The memoize package represents context.Context
types as "&{context Context}" (AST string
representation), not "context.Context".

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore(js): memogen'ed

Signed-off-by: Dwi Siswanto <git@dw1.io>

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>

* fix(js): hangs in checkRDPEncryption

by bounding socket I/O

Add `setConnDeadlineFromContext` helper to set
deadlines on conns derived from context timeouts.
Move conn cleanup out of loop-scoped defers to
make sure immediate cleanup per probe attempt.

Signed-off-by: Dwi Siswanto <git@dw1.io>

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Niek den Breeje <AuditeMarlow@users.noreply.github.com>
Co-authored-by: Dwi Siswanto <25837540+dwisiswant0@users.noreply.github.com>
Co-authored-by: Dwi Siswanto <git@dw1.io>
2026-04-01 14:53:13 +07:00
Mzack9999 5d79201299 fix(js): incorrect postgres exec call signature (#6731)
Make sure postgres Exec/ExecContext are invoked with the correct
argument order, preventing context from being passed as the query.

* fixing pg syntax

* adding test
2025-12-24 03:20:50 +07:00
Dwi Siswanto 7fc4752a95 chore(js): migrate github.com/go-pg/pg => github.com/go-pg/pg/v10
Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-11-02 01:12:11 +07:00
Tarun Koyalwar 19247ae74b Path-Based Fuzzing SQL fix (#6400)
* setup claude

* migrate to using errkit

* fix unused imports + lint errors

* update settings.json

* fix url encoding issue

* fix lint error

* fix the path fuzzing component

* fix lint error
2025-08-25 13:36:58 +05:30
Sandeep Singh b4644af80a Lint + test fixes after utils dep update (#6393)
* fix: remove undefined errorutil.ShowStackTrace

* feat: add make lint support and integrate with test

* refactor: migrate errorutil to errkit across codebase

- Replace deprecated errorutil with modern errkit
- Convert error declarations from var to func for better compatibility
- Fix all SA1019 deprecation warnings
- Maintain error chain support and stack traces

* fix: improve DNS test reliability using Google DNS

- Configure test to use Google DNS (8.8.8.8) for stability
- Fix nil pointer issue in DNS client initialization
- Keep production defaults unchanged

* fixing logic

* removing unwanted branches in makefile

---------

Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
2025-08-20 05:28:23 +05:30
HD Moore f26996cb89 Remove singletons from Nuclei engine (continuation of #6210) (#6296)
* introducing execution id

* wip

* .

* adding separate execution context id

* lint

* vet

* fixing pg dialers

* test ignore

* fixing loader FD limit

* test

* fd fix

* wip: remove CloseProcesses() from dev merge

* wip: fix merge issue

* protocolstate: stop memguarding on last dialer delete

* avoid data race in dialers.RawHTTPClient

* use shared logger and avoid race conditions

* use shared logger and avoid race conditions

* go mod

* patch executionId into compiled template cache

* clean up comment in Parse

* go mod update

* bump echarts

* address merge issues

* fix use of gologger

* switch cmd/nuclei to options.Logger

* address merge issues with go.mod

* go vet: address copy of lock with new Copy function

* fixing tests

* disable speed control

* fix nil ExecuterOptions

* removing deprecated code

* fixing result print

* default logger

* cli default logger

* filter warning from results

* fix performance test

* hardcoding path

* disable upload

* refactor(runner): uses `Warning` instead of `Print` for `pdcpUploadErrMsg`

Signed-off-by: Dwi Siswanto <git@dw1.io>

* Revert "disable upload"

This reverts commit 114fbe6663.

* Revert "hardcoding path"

This reverts commit cf12ca800e.

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
Co-authored-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Dwi Siswanto <25837540+dwisiswant0@users.noreply.github.com>
2025-07-10 01:17:26 +05:30
Dwi Siswanto 87ed0b2bb9 build: bump all direct modules (#6290)
* chore: fix non-constant fmt string in call

Signed-off-by: Dwi Siswanto <git@dw1.io>

* build: bump all direct modules

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore(hosterrorscache): update import path

Signed-off-by: Dwi Siswanto <git@dw1.io>

* fix(charts): break changes

Signed-off-by: Dwi Siswanto <git@dw1.io>

* build: pinned `github.com/zmap/zcrypto` to v0.0.0-20240512203510-0fef58d9a9db

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore: golangci-lint auto fixes

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore: satisfy lints

Signed-off-by: Dwi Siswanto <git@dw1.io>

* build: migrate `github.com/xanzy/go-gitlab` => `gitlab.com/gitlab-org/api/client-go`

Signed-off-by: Dwi Siswanto <git@dw1.io>

* feat(json): update build constraints

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore: dont panicking on close err

Signed-off-by: Dwi Siswanto <git@dw1.io>

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-07-01 00:40:44 +07:00
Mzack9999 1c24ceda45 adding automatic service check on query (#5291)
* adding automatic service check on query

* automatic service check
2024-07-08 17:08:29 +05:30
Tarun Koyalwar 23bd0336fb multiple bug fixes + performance improvements (#5148)
* prototype errkit

* complete errkit implementation

* add cause to all timeouts

* fix request timeout annotation @timeout

* increase responseHeaderTimeout to 8 for stability

* rawhttp error related improvements

* feat: add port status caching

* add port status caching to http

* migrate to new utils/errkit

* remote dialinterface + error cause

* debug dir support using .gitignore debug-*

* make nuclei easy to debug

* debug dir update .gitignore

* temp change (to revert)

* Revert "temp change (to revert)"

This reverts commit d3131f7777.

* use available context instead of new one

* bump fastdialer

* fix hosterrorscache + misc improvements

* add 'address' field in error log

* fix js vague errors + pgwrap driver

* fix max host error + misc updates

* update tests as per changes

* fix request annotation context

* remove closed dialer reference

* fix sdk panic issue

* bump retryablehttp-go,utils,fastdialer

---------

Co-authored-by: Sandeep Singh <sandeep@projectdiscovery.io>
2024-05-25 00:29:04 +05:30
Ice3man 4170e1cbb8 more goroutine leak fixes to nuclei (#5188)
* more goroutine leak fixes to nuclei

* run only dns templates for test

* updated httpx to dev

* dep update

---------

Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2024-05-20 00:48:40 +05:30
Mzack9999 4c7a0f424e Transparent Memoization via func Annotation (#4742)
* initial implementation with manual code generation

* testing generation

* refactor to package methods + auto memoize

* more memos

* fixing signatures

* refactor

* adding gen util

* adding util

* regenerate memoized files

---------

Co-authored-by: Tarun Koyalwar <tarun@projectdiscovery.io>
2024-03-01 18:40:18 +05:30
Tarun Koyalwar 8a2ff17ad8 allow specifying self-contained at http request level (#4812)
* allow specifying self-contained at requestlevel

* fix IsSMTP js example

* update smtp + fix examples

* update smtp error message

* add code reference in js protocol

* update js docs

* remove debug stmt
2024-03-01 16:38:56 +05:30
Tarun Koyalwar 36985345a9 javascript bindings + docs generation enhancements ( generate typescript defination .d.ts files) (#4487)
* introduce typescript files generation using ast + tmpl

* feat valid ts with scraping

* feat remove old logic + tsdocs for all modules

* fix ikev and related bugs

* typescript docs for js modules

* lint,build + ldap realm fix

* go mod tidy

* fix named imports ast parsing

* fix ast code generation errors

* complete support for ts files generation

* support go global/const in ts docs

* updated template

* feat: typescript using go code generation

* nuke jsdoc generator

* update generated ts dir structure

* fix multifile ts gen issue

* fix panic in ts code gen

* fix test

* update docs of js libs

* feat: add doc+example for every js class,function,method

* fix missing quotes in ikev example

---------

Co-authored-by: Sandeep Singh <sandeep@projectdiscovery.io>
2024-02-07 21:45:40 +05:30
Tarun Koyalwar cc732875cd javascript: pooling and reuse with export functions + misc updates (#4709)
* js hotfix: wrap javascript source in anon functions

* mysql module improvements

* misc mysql bugs

* js vm pooling: soft deprecation + incentivised pooling

* misc updates

* disable interactsh failed test

* disable interactsh.yaml integration test on win & mac
2024-02-02 02:22:04 +05:30
Tarun Koyalwar dc44105baf nuclei v3 : misc updates (#4247)
* use parsed options while signing

* update project layout to v3

* fix .gitignore

* remove example template

* misc updates

* bump tlsx version

* hide template sig warning with env

* js: retain value while using log

* fix nil pointer derefernce

* misc doc update

---------

Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-10-17 17:44:13 +05:30