- Update -omit-raw help text to include PDF in scope
- Move require.NoError out of goroutine in concurrency test (FailNow semantics)
- Truncate raw request/response at buffer time in Export() to prevent memory accumulation
* fix(expressions): only eval template-authored expressions
`expressions.Evaluate()` currently replaces
placeholders first and then scans the substituted
output for expressions which allows
response-derived values, including extractor
output, to be reinterpreted as DSL/helper syntax
on a second pass, which then becomes more serious
when env-backed variables are enabled.
So making this by collecting expressions from the
original template text before placeholder
substitution and then evaluating only those
original expressions after normal replacement to
keep trusted template-authored helpers working,
including placeholders nested inside helper
arguments while treating substituted response data
as literal text.
Fixes#7210
Signed-off-by: Dwi Siswanto <git@dw1.io>
* test: add resp data literal reuse test
Signed-off-by: Dwi Siswanto <git@dw1.io>
---------
Signed-off-by: Dwi Siswanto <git@dw1.io>
Replace insecure math/rand PRNG with crypto/rand in Rand() and
RandInt() JavaScript helper functions. math/rand is predictable
and unsuitable when these functions are used for generating
security-sensitive values like tokens or nonces in templates.
Implements context-aware XSS reflection analysis for the nuclei fuzzing
engine, addressing issue #5838. Uses golang.org/x/net/html tokenizer
for robust context detection across 8 injection contexts including
javascript: URIs, non-executable script blocks, srcdoc attributes,
event handlers, style blocks, and HTML comments.
All 48 tests pass with comprehensive table-driven coverage including
malformed HTML, empty inputs, and case-insensitive matching.
Zero modifications to existing files.
Retain the old exported identifier as a deprecated alias pointing to
the corrected ExcludedDastTmplStats so external consumers are not broken
by the rename.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Uses metadata caching via catalog index to reduce
runtime overhead.
Add `(*Store).LoadTemplateTags` for efficient tag
aggregation.
Signed-off-by: Dwi Siswanto <git@dw1.io>
Tag listing (`-tgl`) output was moved to debug log
level, making it invisible during normal runs.
Restore tag output to default log level (Print)
for better usability.
Fixes#7142
Signed-off-by: Dwi Siswanto <git@dw1.io>
In host-spray mode (executeTemplatesOnTarget), the goroutine-spawn loop
iterated over ALL templates for a target even after HostErrorsCache had
marked that target as permanently unresponsive. Each spawned goroutine
immediately detected the unresponsive state and wrote a 'skipped' event
to the output before returning.
Without JSON output the skip events are cheap (no I/O), so the scan
still finishes quickly. With -j or -je enabled, each skip event
triggers a synchronous JSON write; for a full template set (~18k
templates) this serialises thousands of writes and keeps the process
running for hours instead of the expected few minutes (issue #7049).
Fix: check HostErrorsCache at the top of the template-spawn loop and
break out as soon as the target is known to be permanently unresponsive.
This mirrors the identical guard already present in the template-spray
path (executeTemplateWithTargets, line 153) and avoids spawning
O(templates) no-op goroutines for dead hosts.
Fixes#7049
The time_delay analyzer's reqSender rebuilt follow-up requests from
gr.Component.Rebuild() which clones the component's base request. That
base request is parsed from rule.BaseRequest *before* post-parse header
injection happens (custom -H flags, auth provider headers, cookies).
As a result every follow-up request was sent without the headers that the
original triggering request carried, including Cookie/Authorization —
the server rejected them or ran the SQL in an unauthenticated context.
Fix: after Rebuild(), copy the complete header set from gr.Request (the
original fuzz-generated request, which has all headers) into the rebuilt
request. This mirrors the same approach used everywhere else in the
request pipeline and makes the time_delay analyzer behave consistently.
Fixes#7106
* Updated `.github/workflows/tests.yaml`:
* Added `GITHUB_TOKEN` to `validate` job to
support `make template-validate`.
* Updated `.github/workflows/flamegraph.yaml`:
* Added `GITHUB_TOKEN` to `flamegraph` job for
`nuclei -update-templates`.
* Updated `.github/workflows/generate-pgo.yaml`:
* Added `GITHUB_TOKEN` to `pgo` job for
`nuclei -update-templates`.
This make sure auth'd GitHub API calls during
template updates, avoiding rate limit issues.
Signed-off-by: Dwi Siswanto <git@dw1.io>
Apply request annotations during `unsafe` raw
request generation so @Host/@timeout/etc affect
the effective target and execution context.
Strip leading annotation directives from `unsafe`
wire bytes before sending, since `rawhttp`
transmits raw payload verbatim and annotation
lines can produce malformed HTTP requests.
Close#6747
Signed-off-by: Dwi Siswanto <git@dw1.io>
Prev. project keyed cache lookups from dumped HTTP
request bytes alone. For eq requests, this allowed
"http" and "https" targets to collide and reuse
cached responses across schemes.
Derive a scoped cache key by prefixing normalized
scheme://host before `projectfile.{Get,Set}`
keying input in the HTTP protocol path.
Close#6866
Signed-off-by: Dwi Siswanto <git@dw1.io>
Fix ambiguous interpretation of IPv6 addresses
like "::1:8065" by bracketing them before URL
formation to make sure they are treated as hosts
rather than "host:port" pairs.
Close#6960
Signed-off-by: Dwi Siswanto <git@dw1.io>
Resume files are runtime artifacts and SHOULD NOT
be presented as persistent config.
Update reset messaging to separate config vs cache
and explicitly include resume state under cache
cleanup. Also delete the cache dir during `-reset`
to keep behavior aligned with the new semantics.
Close#6792
Signed-off-by: Dwi Siswanto <git@dw1.io>
Mzack9999