admin/projectdiscovery-nuclei
1
0
Fork 0
mirror of https://github.com/projectdiscovery/nuclei synced 2026-06-08 16:50:47 +00:00
Code Issues Packages Projects Releases Wiki Activity
6,344 Commits 66 Branches 143 Tags
dev
Commit Graph

6344 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot] 75e67a5e89 chore(deps): bump crate-ci/typos in the workflows group (#7330) 
Bumps the workflows group with 1 update: [crate-ci/typos](https://github.com/crate-ci/typos).


Updates `crate-ci/typos` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](https://github.com/crate-ci/typos/compare/v1.44.0...v1.45.0)

---
updated-dependencies:
- dependency-name: crate-ci/typos
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: workflows
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-08 04:48:46 +07:00
dependabot[bot] a2fb27aae2 chore(deps): bump the modules group with 3 updates (#7329) 
Bumps the modules group with 3 updates: [github.com/projectdiscovery/retryablehttp-go](https://github.com/projectdiscovery/retryablehttp-go), [github.com/projectdiscovery/wappalyzergo](https://github.com/projectdiscovery/wappalyzergo) and [github.com/projectdiscovery/cdncheck](https://github.com/projectdiscovery/cdncheck).


Updates `github.com/projectdiscovery/retryablehttp-go` from 1.3.7 to 1.3.8
- [Release notes](https://github.com/projectdiscovery/retryablehttp-go/releases)
- [Commits](https://github.com/projectdiscovery/retryablehttp-go/compare/v1.3.7...v1.3.8)

Updates `github.com/projectdiscovery/wappalyzergo` from 0.2.74 to 0.2.75
- [Release notes](https://github.com/projectdiscovery/wappalyzergo/releases)
- [Commits](https://github.com/projectdiscovery/wappalyzergo/compare/v0.2.74...v0.2.75)

Updates `github.com/projectdiscovery/cdncheck` from 1.2.29 to 1.2.30
- [Release notes](https://github.com/projectdiscovery/cdncheck/releases)
- [Commits](https://github.com/projectdiscovery/cdncheck/compare/v1.2.29...v1.2.30)

---
updated-dependencies:
- dependency-name: github.com/projectdiscovery/retryablehttp-go
  dependency-version: 1.3.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/wappalyzergo
  dependency-version: 0.2.75
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/cdncheck
  dependency-version: 1.2.30
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-06 06:16:29 +00:00
Doğan Can Bakır 10cccb7f3c fix headless JS loading with -tlsi and addheader/setheader 2026-04-02 17:44:49 +05:30
Dwi Siswanto 68e49a7981 fix(interactsh): serialize InternalEvent access 
`interactsh.(*Client).processInteractionForRequest`
was updating the wrapped event under lock but
releasing it before calling `Operators.Execute()`,
allowing async interactsh updates to race with
matcher expr evaluation on the same `InternalEvent`
map, causing fatal concurrent map iteration/write
crashes.

Hold the event lock while populating interactsh
fields and running operators, and use a locked
`eventHash()` helper for matched-template cache
lookups that access the same event data.

Fixes #7319

Signed-off-by: Dwi Siswanto <git@dw1.io>
 2026-04-02 11:48:33 +07:00
Dogan Can Bakir c6fb1ae486 Merge pull request #7311 from projectdiscovery/dwisiswant0/test/add-fuzz-tests 
test: add fuzz tests
 2026-04-01 12:25:03 +03:00
Mzack9999 3537030e1f fix(js): watchdog + propagates context to all JS library network calls (#7299) 
* fix(js): prevent pool slot starvation under load

Zombie goroutines from timed-out JS executions held pool slots
indefinitely: Add() blocked with context.Background(), and defer Done()
only ran when the goroutine eventually completed. Under load, both
pools (80 pooled + 20 non-pooled slots) filled with zombies, silently
dropping all subsequent matches.

Three changes fix slot lifecycle management:

1. Propagate the 20s deadline context into ExecuteProgram (compiler.go)
   so both execution paths can respect the deadline.

2. Replace Add() with AddWithContext(ctx) in both pool.go and
   non-pool.go so goroutines waiting for a slot fail fast when the
   deadline expires instead of blocking indefinitely.

3. Add a watchdog goroutine that releases the slot when the deadline
   expires, even if the zombie is still running. An atomic.Bool
   ensures exactly one Done() call between the watchdog and the
   normal defer path.

* adding context

* refactor(js): derived the ctx to remaining tractable deadline leaks (#7302)

* refactor(js): use `context.Background` as default instead

Signed-off-by: Dwi Siswanto <git@dw1.io>

* refactor(js): derived the ctx to remaining tractable deadline leaks

Signed-off-by: Dwi Siswanto <git@dw1.io>

* test(js): add `NucleiJS.Context` tests

Signed-off-by: Dwi Siswanto <git@dw1.io>

* fix(cmd): context param exclusion in memoization hash

The memoization template condition for excluding
context parameters from hash keys was incorrect.
The memoize package represents context.Context
types as "&{context Context}" (AST string
representation), not "context.Context".

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore(js): memogen'ed

Signed-off-by: Dwi Siswanto <git@dw1.io>

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>

* fix(js): hangs in checkRDPEncryption

by bounding socket I/O

Add `setConnDeadlineFromContext` helper to set
deadlines on conns derived from context timeouts.
Move conn cleanup out of loop-scoped defers to
make sure immediate cleanup per probe attempt.

Signed-off-by: Dwi Siswanto <git@dw1.io>

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Niek den Breeje <AuditeMarlow@users.noreply.github.com>
Co-authored-by: Dwi Siswanto <25837540+dwisiswant0@users.noreply.github.com>
Co-authored-by: Dwi Siswanto <git@dw1.io>
 2026-04-01 14:53:13 +07:00
Dwi Siswanto 35146e0a43 test: add fuzz tests 
Signed-off-by: Dwi Siswanto <git@dw1.io>
 2026-03-31 15:07:08 +07:00
dependabot[bot] 4ae87beedd chore(deps): bump github.com/go-git/go-git/v5 (#7310) 
Bumps the go_modules group with 1 update in the / directory: [github.com/go-git/go-git/v5](https://github.com/go-git/go-git).


Updates `github.com/go-git/go-git/v5` from 5.16.5 to 5.17.1
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.16.5...v5.17.1)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.17.1
  dependency-type: direct:production
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-30 17:40:39 +00:00
dependabot[bot] 78dbaebd4a chore(deps): bump the modules group with 6 updates (#7309) 
Bumps the modules group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/projectdiscovery/fastdialer](https://github.com/projectdiscovery/fastdialer) | `0.5.5` | `0.5.6` |
| [github.com/projectdiscovery/retryablehttp-go](https://github.com/projectdiscovery/retryablehttp-go) | `1.3.6` | `1.3.7` |
| [github.com/projectdiscovery/networkpolicy](https://github.com/projectdiscovery/networkpolicy) | `0.1.35` | `0.1.36` |
| [github.com/projectdiscovery/ratelimit](https://github.com/projectdiscovery/ratelimit) | `0.0.84` | `0.0.85` |
| [github.com/projectdiscovery/wappalyzergo](https://github.com/projectdiscovery/wappalyzergo) | `0.2.73` | `0.2.74` |
| [github.com/projectdiscovery/cdncheck](https://github.com/projectdiscovery/cdncheck) | `1.2.28` | `1.2.29` |


Updates `github.com/projectdiscovery/fastdialer` from 0.5.5 to 0.5.6
- [Release notes](https://github.com/projectdiscovery/fastdialer/releases)
- [Commits](https://github.com/projectdiscovery/fastdialer/compare/v0.5.5...v0.5.6)

Updates `github.com/projectdiscovery/retryablehttp-go` from 1.3.6 to 1.3.7
- [Release notes](https://github.com/projectdiscovery/retryablehttp-go/releases)
- [Commits](https://github.com/projectdiscovery/retryablehttp-go/compare/v1.3.6...v1.3.7)

Updates `github.com/projectdiscovery/networkpolicy` from 0.1.35 to 0.1.36
- [Release notes](https://github.com/projectdiscovery/networkpolicy/releases)
- [Commits](https://github.com/projectdiscovery/networkpolicy/compare/v0.1.35...v0.1.36)

Updates `github.com/projectdiscovery/ratelimit` from 0.0.84 to 0.0.85
- [Release notes](https://github.com/projectdiscovery/ratelimit/releases)
- [Commits](https://github.com/projectdiscovery/ratelimit/compare/v0.0.84...v0.0.85)

Updates `github.com/projectdiscovery/wappalyzergo` from 0.2.73 to 0.2.74
- [Release notes](https://github.com/projectdiscovery/wappalyzergo/releases)
- [Commits](https://github.com/projectdiscovery/wappalyzergo/compare/v0.2.73...v0.2.74)

Updates `github.com/projectdiscovery/cdncheck` from 1.2.28 to 1.2.29
- [Release notes](https://github.com/projectdiscovery/cdncheck/releases)
- [Commits](https://github.com/projectdiscovery/cdncheck/compare/v1.2.28...v1.2.29)

---
updated-dependencies:
- dependency-name: github.com/projectdiscovery/fastdialer
  dependency-version: 0.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/retryablehttp-go
  dependency-version: 1.3.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/networkpolicy
  dependency-version: 0.1.36
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/ratelimit
  dependency-version: 0.0.85
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/wappalyzergo
  dependency-version: 0.2.74
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/cdncheck
  dependency-version: 1.2.29
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-30 06:17:58 +00:00
dependabot[bot] 2e895d79ac chore(deps): bump github.com/antchfx/xpath (#7308) 
Bumps the go_modules group with 1 update in the / directory: [github.com/antchfx/xpath](https://github.com/antchfx/xpath).


Updates `github.com/antchfx/xpath` from 1.3.5 to 1.3.6
- [Release notes](https://github.com/antchfx/xpath/releases)
- [Commits](https://github.com/antchfx/xpath/compare/v1.3.5...v1.3.6)

---
updated-dependencies:
- dependency-name: github.com/antchfx/xpath
  dependency-version: 1.3.6
  dependency-type: direct:production
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-29 21:05:49 +00:00
Doğan Can Bakır cb0a9f4621 support service names in network template port field 2026-03-26 17:49:22 +03:00
Mzack9999 9e2366f21f Merge pull request #7294 from mikhail5555/fix/data-race-condition-global-variable 
Fix(clientpool): remove global variable from clientpool in favour for local variable
 2026-03-25 18:48:29 +01:00
Mzack9999 aa529cdf63 Merge pull request #7300 from projectdiscovery/5095-flow-request-condition-tests 
test(flow): add request condition tests for multi-raw-request templates
 2026-03-25 18:29:55 +01:00
Mzack9999 a8c8645203 remove init 2026-03-25 17:56:35 +01:00
Mzack9999 986aef46eb lint 2026-03-25 17:37:46 +01:00
Dogan Can Bakir 4177a48942 Merge pull request #7298 from projectdiscovery/7295-dynamic-auth-flow-fix 
fixing flow with auth
 2026-03-25 13:06:55 +03:00
Mzack9999 db06e2cb35 adding tests 2026-03-24 23:54:20 +01:00
Mzack9999 ab0199b410 fixing flow with auth 2026-03-24 21:57:03 +01:00
Dogan Can Bakir c8a9853ff1 Merge pull request #7125 from usernametooshort/fix/time-delay-missing-custom-headers 
fix(fuzz): propagate custom headers to time_delay analyzer follow-up requests
 2026-03-24 21:14:10 +03:00
Dogan Can Bakir a86ee99ed6 Merge pull request #7292 from projectdiscovery/5350-code-execution-error-logging 
capturing stderr
 2026-03-24 21:12:25 +03:00
dependabot[bot] e5e8dc7cdc chore(deps): bump the modules group with 8 updates (#7288) 
Bumps the modules group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/projectdiscovery/fastdialer](https://github.com/projectdiscovery/fastdialer) | `0.5.4` | `0.5.5` |
| [github.com/projectdiscovery/retryabledns](https://github.com/projectdiscovery/retryabledns) | `1.0.113` | `1.0.114` |
| [github.com/projectdiscovery/dsl](https://github.com/projectdiscovery/dsl) | `0.8.13` | `0.8.14` |
| [github.com/projectdiscovery/networkpolicy](https://github.com/projectdiscovery/networkpolicy) | `0.1.34` | `0.1.35` |
| [github.com/projectdiscovery/ratelimit](https://github.com/projectdiscovery/ratelimit) | `0.0.83` | `0.0.84` |
| [github.com/projectdiscovery/utils](https://github.com/projectdiscovery/utils) | `0.9.0` | `0.10.0` |
| [github.com/projectdiscovery/wappalyzergo](https://github.com/projectdiscovery/wappalyzergo) | `0.2.71` | `0.2.73` |
| [github.com/projectdiscovery/cdncheck](https://github.com/projectdiscovery/cdncheck) | `1.2.26` | `1.2.28` |


Updates `github.com/projectdiscovery/fastdialer` from 0.5.4 to 0.5.5
- [Release notes](https://github.com/projectdiscovery/fastdialer/releases)
- [Commits](https://github.com/projectdiscovery/fastdialer/compare/v0.5.4...v0.5.5)

Updates `github.com/projectdiscovery/retryabledns` from 1.0.113 to 1.0.114
- [Release notes](https://github.com/projectdiscovery/retryabledns/releases)
- [Commits](https://github.com/projectdiscovery/retryabledns/compare/v1.0.113...v1.0.114)

Updates `github.com/projectdiscovery/dsl` from 0.8.13 to 0.8.14
- [Release notes](https://github.com/projectdiscovery/dsl/releases)
- [Commits](https://github.com/projectdiscovery/dsl/compare/v0.8.13...v0.8.14)

Updates `github.com/projectdiscovery/networkpolicy` from 0.1.34 to 0.1.35
- [Release notes](https://github.com/projectdiscovery/networkpolicy/releases)
- [Commits](https://github.com/projectdiscovery/networkpolicy/compare/v0.1.34...v0.1.35)

Updates `github.com/projectdiscovery/ratelimit` from 0.0.83 to 0.0.84
- [Release notes](https://github.com/projectdiscovery/ratelimit/releases)
- [Commits](https://github.com/projectdiscovery/ratelimit/compare/v0.0.83...v0.0.84)

Updates `github.com/projectdiscovery/utils` from 0.9.0 to 0.10.0
- [Release notes](https://github.com/projectdiscovery/utils/releases)
- [Changelog](https://github.com/projectdiscovery/utils/blob/main/CHANGELOG.md)
- [Commits](https://github.com/projectdiscovery/utils/compare/v0.9.0...v0.10.0)

Updates `github.com/projectdiscovery/wappalyzergo` from 0.2.71 to 0.2.73
- [Release notes](https://github.com/projectdiscovery/wappalyzergo/releases)
- [Commits](https://github.com/projectdiscovery/wappalyzergo/compare/v0.2.71...v0.2.73)

Updates `github.com/projectdiscovery/cdncheck` from 1.2.26 to 1.2.28
- [Release notes](https://github.com/projectdiscovery/cdncheck/releases)
- [Commits](https://github.com/projectdiscovery/cdncheck/compare/v1.2.26...v1.2.28)

---
updated-dependencies:
- dependency-name: github.com/projectdiscovery/fastdialer
  dependency-version: 0.5.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/retryabledns
  dependency-version: 1.0.114
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/dsl
  dependency-version: 0.8.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/networkpolicy
  dependency-version: 0.1.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/ratelimit
  dependency-version: 0.0.84
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/utils
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/wappalyzergo
  dependency-version: 0.2.73
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: modules
- dependency-name: github.com/projectdiscovery/cdncheck
  dependency-version: 1.2.28
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-24 17:48:26 +07:00
Mzack9999 233af2cd9e fix(websocket): path handling when merging template & target URLs (#7290) 2026-03-24 17:47:43 +07:00
Mzack9999 c2f3397fa4 fix(fuzz): concurrent map writes in multipart form parsing (#7291) 2026-03-24 17:43:27 +07:00
Mikhail Epifanov 49a0ffe796 only override maxRedirects if options.MaxRedirects > 0 2026-03-24 09:33:51 +01:00
Mikhail Epifanov 9cc8456902 remove global variable from clientpool in favour for local variable 2026-03-24 09:17:53 +01:00
Mzack9999 406ad1a5fa Merge pull request #6944 from maxwolf8852/fix/noHostErrors-panic 
fix: remove nil interface set in createEphemeralObjects to avoid panic
 2026-03-24 02:16:17 +01:00
Mzack9999 18ab9175cf adding tests 2026-03-24 00:24:11 +01:00
Mzack9999 3a004d1d46 capturing stderr 2026-03-24 00:11:41 +01:00
Mzack9999 4344080739 fix lint 2026-03-23 23:54:38 +01:00
Mzack9999 625d68301f fixing test 2026-03-23 23:48:41 +01:00
Mzack9999 3d259eb872 Merge branch 'dev' into pr/6944 2026-03-23 21:41:22 +01:00
Dogan Can Bakir e4edd5a8c9 Merge pull request #7286 from projectdiscovery/4685-fix-fhr-redirect-port-normalization 
fixing redirect
 2026-03-23 17:51:35 +03:00
Dogan Can Bakir f70353b053 Merge pull request #7287 from projectdiscovery/4927-fix-elasticsearch-ip-host-validation 
fixing elastic export
 2026-03-23 17:34:56 +03:00
dependabot[bot] 35e7d6ee29 chore(deps): bump the workflows group with 2 updates (#7289) 
Bumps the workflows group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [crate-ci/typos](https://github.com/crate-ci/typos).


Updates `actions/checkout` from 4 to 6
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v6)

Updates `crate-ci/typos` from 1.28.4 to 1.44.0
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](https://github.com/crate-ci/typos/compare/v1.28.4...v1.44.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: workflows
- dependency-name: crate-ci/typos
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: workflows
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-23 06:07:09 +00:00
Mzack9999 54cc7d20cc fixing elastic export 2026-03-23 01:21:20 +01:00
Mzack9999 2f03145f5d fixing redirect 2026-03-23 01:02:21 +01:00
Mikel Olasagasti Uranga 6eda56f389 Remove executable bit (#7282) 2026-03-22 01:55:54 +07:00
Mzack9999 48e05ca32e Merge pull request #7277 from HarshadaGawas05/feat/honeypot-detection 
feat: add honeypot detection to reduce scan noise (#6403)
 2026-03-20 17:09:58 +01:00
Mzack9999 3bcf21d398 small fix 2026-03-20 16:40:42 +01:00
Mzack9999 63d0df9506 fmt + docs 2026-03-20 16:16:17 +01:00
ghost d5eafebad2 docs: update syntax & JSON schema 🤖 2026-03-20 14:15:36 +00:00
Mzack9999 22e325f13e Merge pull request #7164 from ZachL111/feat/xss-context-analyzer 
feat(fuzz): add XSS reflection context analyzer
 2026-03-20 15:13:54 +01:00
Mzack9999 29ae75b7dc adding interface 2026-03-20 14:18:29 +01:00
Mzack9999 199c0e4d00 Merge remote-tracking branch 'origin/dev' into pr/7164 2026-03-20 14:13:57 +01:00
saurabh 5e8ef276a0 add inline targets and secrets to template profiless (#5567) (#6858) 
* feat: template profile inline targets and secrets (#5567)

* fix inline secrets temp file edge cases

* fixing lint

---------

Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
 2026-03-20 13:57:18 +01:00
Harshada Gawas 658df54f48 feat: add honeypot detection to reduce scan noise (#6403) 2026-03-20 14:05:21 +05:30
Ahmed Elgharabawy 0ae6d9040c fix(fuzz): use actual parameter for frequency dedupe (#7037) 
Fix numeric path fuzz dedupe by using actualParameter for frequency
checks and add regression tests for numeric index and actual value
behavior.
 2026-03-20 04:14:16 +01:00
Youssef Nagy 67e880691b fix(fuzz): prevent path mutation across sequential Rebuild calls (#6398) (#7253) 
* fix(fuzz): prevent path mutation across sequential Rebuild calls (#6398)

retryablehttp.Request.Clone() shares the URL pointer, so when
Rebuild() calls UpdateRelPath() on the cloned request it mutates
q.req.URL.Path. On subsequent Rebuild() calls the original path
segments are wrong, causing corrupted fuzz requests (especially
visible with numeric path parts like /user/55/profile).

Snapshot the original path during Parse() and use the snapshot in
Rebuild() instead of reading from the mutable request.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* remove embedded URL field

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
 2026-03-20 02:40:18 +01:00
Hussain Alsaibai 9caa62ebd5 fix: resolve auth secret file race condition using sync.Once (#6976) 
This commit fixes a race condition where templates start executing before
the secret file's login flow completes when using -secret-file flag.

Changes:
- pkg/authprovider/authx/dynamic.go: Replace atomic.Bool-based synchronization
  with sync.Once to ensure fetch callback runs exactly once and all concurrent
  callers block until completion. This prevents the race where multiple goroutines
  would see fetching=true and return early with nil error before secrets were ready.

- internal/runner/runner.go: Always prefetch secrets when AuthProvider exists,
  removing the PreFetchSecrets flag check. This ensures authentication completes
  before scanning starts regardless of flag settings.

- lib/sdk_private.go: Same change as runner.go for SDK mode consistency.

- pkg/authprovider/file_test.go: Add test for concurrent dynamic secret access
  to verify fetch happens exactly once and all workers get authenticated.

- pkg/authprovider/authx/dynamic_test.go: Add concurrent fetch tests to verify
  proper synchronization behavior.

Fixes #6592

Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
 2026-03-20 01:16:28 +01:00
dependabot[bot] 35e6e943b1 chore(deps): bump github.com/buger/jsonparser (#7272) 
Bumps the go_modules group with 1 update in the / directory: [github.com/buger/jsonparser](https://github.com/buger/jsonparser).


Updates `github.com/buger/jsonparser` from 1.1.1 to 1.1.2
- [Release notes](https://github.com/buger/jsonparser/releases)
- [Commits](https://github.com/buger/jsonparser/compare/v1.1.1...v1.1.2)

---
updated-dependencies:
- dependency-name: github.com/buger/jsonparser
  dependency-version: 1.1.2
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-19 23:39:36 +00:00