25 Commits
Author SHA1 Message Date
dw1andMzack9999 3fdb599603 fix(js): stop tsgen from panicking on non-struct types (#8102)
* fix(js/tsgen): map non-struct external types to any

tsgen treated every type from another package as a struct and queued
it to have its fields scraped into a TypeScript interface. The kind
was checked only at scrape time, as a fatal error, so an interface,
func, or named basic type in an exported signature or field aborted
the whole run. make jsupdate-tsgen panicked on net.Conn, which the
dcerpc, gptransport, mssql, net, and oracle libraries return, and
never wrote the remaining definitions or index.ts.

Check the kind when the type is first seen instead. Structs are still
scraped; other types have no fields to describe and become any, as
external parameter types already do. Names that do not resolve are
still reported.

Fixes: #8099
Signed-off-by: Dwi Siswanto <[email protected]>

* fix(js): exclude gptransport and smbsession from codegen

gptransport and smbsession are shared Go adapters for the smb, dcerpc,
and file protocol code, not JavaScript modules: nothing registers them
with the runtime, and index.ts does not export them. Without the
.nuclei-jsgen-ignore marker that goexec already carries, tsgen and
bindgen treat them as modules, so a full make jsupdate-tsgen run
writes gptransport.ts and smbsession.ts and adds both to index.ts.

Refs: #8099
Signed-off-by: Dwi Siswanto <[email protected]>

* fix returns

---------

Signed-off-by: Dwi Siswanto <[email protected]>
Co-authored-by: Mzack9999 <[email protected]>
2026-11-10 07:01:54 +07:00
Dwi Siswanto ec6794c2b4 fix(js/tsgen): report package load errors instead of ignoring them
packages.Load records parse, type, and list errors in Package.Errors
and still returns a nil error. NewEntityParser and loadPackage checked
only the returned error, so tsgen accepted packages that do not
compile. Parse then panicked in extractParameters on the recovered
syntax tree, or looked up types in an empty package and reported a
misleading "type not found" error.

Both call sites now load through loadPackage, which returns the
package errors with the package ID and file positions.

Fixes: #8098
Signed-off-by: Dwi Siswanto <[email protected]>
2026-11-09 23:29:03 +07:00
Doğan Can Bakır e8b53505e5 fix(js): use projectdiscovery/goja import in bindgen template 2026-09-22 12:41:44 +03:00
stringsbuilderandMzack9999 ce470c32f8 refactor: replace Split in loops with more efficient SplitSeq (#7278)
* refactor: replace Split in loops with more efficient SplitSeq

Signed-off-by: stringsbuilder <[email protected]>

* minor refactor

* strict checksum

* fix typo

* harden sdk tests

Avoid shared templates-dir update races across parallel go test packages and ignore known leveldb/ratelimit/memguardian goroutines in goleak.

* bind splitseq temps

Keep SplitSeq inputs in locals so iterator substrings cannot outlive a temporary string expression.

* fix sdk templates

Keep goleak ignores, drop DisableUpdateCheck so CI can install templates, and serialize UpdateIfOutdated across processes.

---------

Signed-off-by: stringsbuilder <[email protected]>
Co-authored-by: Mzack9999 <[email protected]>
2026-07-22 23:18:56 +04:00
Dwi Siswanto 65d08b33ef feat(js): add wmi, tsch, scmr, and dcom helper modules
Add shared auth, options, result, redaction, and
adapter support for GoExec-backed JavaScript
helpers, including:

* `nuclei/wmi`
* `nuclei/tsch`
* `nuclei/scmr`
* `nuclei/dcom`

through generated bindings, and register them with
the JS compiler.

Also make JS generators to skip internal helper
packages and test files.

Signed-off-by: Dwi Siswanto <[email protected]>
2026-05-11 03:57:50 +07:00
Mzack9999 2dad77adaf fix lint 2026-03-16 16:27:00 +01:00
Dwi Siswanto c27c47420f chore: golangci-lint run --fix ./...
Signed-off-by: Dwi Siswanto <[email protected]>
2026-02-26 22:03:14 +07:00
Doğan Can Bakır ef650defb6 Revert "fix(lint): use fmt.Fprintf for remaining WriteString(fmt.Sprintf(...)) calls"
This reverts commit 10421e9d00.
2026-02-26 14:45:25 +03:00
Doğan Can Bakır 10421e9d00 fix(lint): use fmt.Fprintf for remaining WriteString(fmt.Sprintf(...)) calls 2026-02-25 15:34:45 +03:00
Didier Durand 9ec2e995d0 docs: fixing typos in multiple files (#6653)
* [Doc] Fixing typos in multiple files

* [Doc] Fixing js.go based in review suggestion
2025-12-05 12:29:19 +07:00
Patrick Stoeckle bfef42f9e3 chore(typos): fix typos 2025-10-10 17:32:54 +02:00
Tarun Koyalwar 19247ae74b Path-Based Fuzzing SQL fix (#6400)
* setup claude

* migrate to using errkit

* fix unused imports + lint errors

* update settings.json

* fix url encoding issue

* fix lint error

* fix the path fuzzing component

* fix lint error
2025-08-25 13:36:58 +05:30
Sandeep SinghandMzack9999 b4644af80a Lint + test fixes after utils dep update (#6393)
* fix: remove undefined errorutil.ShowStackTrace

* feat: add make lint support and integrate with test

* refactor: migrate errorutil to errkit across codebase

- Replace deprecated errorutil with modern errkit
- Convert error declarations from var to func for better compatibility
- Fix all SA1019 deprecation warnings
- Maintain error chain support and stack traces

* fix: improve DNS test reliability using Google DNS

- Configure test to use Google DNS (8.8.8.8) for stability
- Fix nil pointer issue in DNS client initialization
- Keep production defaults unchanged

* fixing logic

* removing unwanted branches in makefile

---------

Co-authored-by: Mzack9999 <[email protected]>
2025-08-20 05:28:23 +05:30
f26996cb89 Remove singletons from Nuclei engine (continuation of #6210) (#6296)
* introducing execution id

* wip

* .

* adding separate execution context id

* lint

* vet

* fixing pg dialers

* test ignore

* fixing loader FD limit

* test

* fd fix

* wip: remove CloseProcesses() from dev merge

* wip: fix merge issue

* protocolstate: stop memguarding on last dialer delete

* avoid data race in dialers.RawHTTPClient

* use shared logger and avoid race conditions

* use shared logger and avoid race conditions

* go mod

* patch executionId into compiled template cache

* clean up comment in Parse

* go mod update

* bump echarts

* address merge issues

* fix use of gologger

* switch cmd/nuclei to options.Logger

* address merge issues with go.mod

* go vet: address copy of lock with new Copy function

* fixing tests

* disable speed control

* fix nil ExecuterOptions

* removing deprecated code

* fixing result print

* default logger

* cli default logger

* filter warning from results

* fix performance test

* hardcoding path

* disable upload

* refactor(runner): uses `Warning` instead of `Print` for `pdcpUploadErrMsg`

Signed-off-by: Dwi Siswanto <[email protected]>

* Revert "disable upload"

This reverts commit 114fbe6663.

* Revert "hardcoding path"

This reverts commit cf12ca800e.

---------

Signed-off-by: Dwi Siswanto <[email protected]>
Co-authored-by: Mzack9999 <[email protected]>
Co-authored-by: Dwi Siswanto <[email protected]>
Co-authored-by: Dwi Siswanto <[email protected]>
2025-07-10 01:17:26 +05:30
Dwi Siswanto 87ed0b2bb9 build: bump all direct modules (#6290)
* chore: fix non-constant fmt string in call

Signed-off-by: Dwi Siswanto <[email protected]>

* build: bump all direct modules

Signed-off-by: Dwi Siswanto <[email protected]>

* chore(hosterrorscache): update import path

Signed-off-by: Dwi Siswanto <[email protected]>

* fix(charts): break changes

Signed-off-by: Dwi Siswanto <[email protected]>

* build: pinned `github.com/zmap/zcrypto` to v0.0.0-20240512203510-0fef58d9a9db

Signed-off-by: Dwi Siswanto <[email protected]>

* chore: golangci-lint auto fixes

Signed-off-by: Dwi Siswanto <[email protected]>

* chore: satisfy lints

Signed-off-by: Dwi Siswanto <[email protected]>

* build: migrate `github.com/xanzy/go-gitlab` => `gitlab.com/gitlab-org/api/client-go`

Signed-off-by: Dwi Siswanto <[email protected]>

* feat(json): update build constraints

Signed-off-by: Dwi Siswanto <[email protected]>

* chore: dont panicking on close err

Signed-off-by: Dwi Siswanto <[email protected]>

---------

Signed-off-by: Dwi Siswanto <[email protected]>
2025-07-01 00:40:44 +07:00
dac38732dc stop using deprecated mholt/archiver (#5951)
* stop using deprecated mholt/archiver

* Fix CR

* chore: go mod tidy

Signed-off-by: Dwi Siswanto <[email protected]>

---------

Signed-off-by: Dwi Siswanto <[email protected]>
Co-authored-by: Sandeep Singh <[email protected]>
Co-authored-by: Dwi Siswanto <[email protected]>
2025-01-31 13:27:16 +05:30
Tarun KoyalwarandDwi Siswanto 1c76398aea lint error fixes (#5531)
* lint error fixes

* chore: satisfy non-constant format str in call lint (govet)

Signed-off-by: Dwi Siswanto <[email protected]>

---------

Signed-off-by: Dwi Siswanto <[email protected]>
Co-authored-by: Dwi Siswanto <[email protected]>
2024-08-16 20:31:23 +05:30
Ramana Reddy d4e81fd9e6 register goja func to check udp port (#5397)
* register goja func to check port with network param

* register goja func to check udp port
2024-07-15 12:58:30 +05:30
Tarun Koyalwar 255032f4f2 pre-condition in code , fuzz and other misc updates (#4966)
* fuzz: rename 'filters' -> 'pre-condition'

* code proto: pre-condition + integration test

* feat: dsl document generator

* update dsl page header

* fix lint error

* add js defined helper funcs in docs

* remove panic recovery unless its for third party(go-rod,goja)

* handle dynamic values flattening edgecase in flow+multiprotocol

* fix order of kv in form-data (failing test)

* fix template loading counters

* Revert "handle dynamic values flattening edgecase in flow+multiprotocol"

This reverts commit 58fdd4faf7.

* fix flow iteration using 'iterate'
2024-04-01 19:18:21 +05:30
Tarun KoyalwarandSandeep Singh 36985345a9 javascript bindings + docs generation enhancements ( generate typescript defination .d.ts files) (#4487)
* introduce typescript files generation using ast + tmpl

* feat valid ts with scraping

* feat remove old logic + tsdocs for all modules

* fix ikev and related bugs

* typescript docs for js modules

* lint,build + ldap realm fix

* go mod tidy

* fix named imports ast parsing

* fix ast code generation errors

* complete support for ts files generation

* support go global/const in ts docs

* updated template

* feat: typescript using go code generation

* nuke jsdoc generator

* update generated ts dir structure

* fix multifile ts gen issue

* fix panic in ts code gen

* fix test

* update docs of js libs

* feat: add doc+example for every js class,function,method

* fix missing quotes in ikev example

---------

Co-authored-by: Sandeep Singh <[email protected]>
2024-02-07 21:45:40 +05:30
Tarun Koyalwar 3b75db46c7 Merge pull request #4647 from 5amu/remove-kerberos-dependency
switch dependency for kerberos js module (ropnop/gorkb5 -> jcmturner/gokrb5)
2024-02-06 02:37:57 +05:30
Tarun Koyalwarandmzack 5bd9d9ee68 memory leak fixes and optimizations (#4680)
* feat http response memory optimization + reuse buffers

* update nuclei version

* feat: reuse js vm's and compile to programs

* fix failing http integration test

* remove dead code + add -jsc

* feat reuse js vms in pool with concurrency

* update comments as per review

* bug fix+ update interactsh test to look for dns interaction

* try enabling all interactsh integration tests

---------

Co-authored-by: mzack <[email protected]>
2024-01-31 01:59:49 +05:30
Tarun Koyalwar 2c2cc2774a feat: introduce nucleijs utils 2024-01-23 04:11:04 +05:30
Valerio CasalinoandTarun Koyalwar ec5687e2ef Make the SSH client used in javascript templates able to execute custom commands (#4407)
* make ssh module store the connection

* make ssh module able to execute commands using the client

* add bingen + update docs

---------

Co-authored-by: Tarun Koyalwar <[email protected]>
2023-11-24 00:07:45 +05:30
Tarun Koyalwarandsandeep dc44105baf nuclei v3 : misc updates (#4247)
* use parsed options while signing

* update project layout to v3

* fix .gitignore

* remove example template

* misc updates

* bump tlsx version

* hide template sig warning with env

* js: retain value while using log

* fix nil pointer derefernce

* misc doc update

---------

Co-authored-by: sandeep <[email protected]>
2023-10-17 17:44:13 +05:30