fix(reporting): harden Markdown filenames and remediate Go vulnerabilities #7633
+504
−78
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| # Markdown report filenames | ||
|
|
||
| The Markdown exporter writes one result file per finding. Result filenames are | ||
| constructed from the template ID, target host, a random UUID, and—when | ||
| available—the operator name: | ||
|
|
||
| ```text | ||
| <template-id>-<host>-<uuid>-<matcher-or-extractor>.md | ||
| ``` | ||
|
|
||
| The matcher name takes precedence when a result contains both a matcher name | ||
| and an extractor name. For extractor-only results, the extractor name is used. | ||
|
|
||
| ## Safety properties | ||
|
|
||
| Filename components can contain values derived from templates or scan targets, | ||
| so the exporter applies the following rules before writing a report: | ||
|
|
||
| 1. Path separators, parent-directory references, spaces, and characters that | ||
| are unsafe on common filesystems are replaced with underscores. | ||
| 2. Filenames are limited to 255 bytes. | ||
| 3. Truncation stops at a valid UTF-8 boundary. | ||
| 4. The UUID and `.md` extension are always retained when the template ID or | ||
| host must be truncated. | ||
| 5. The operator name is sanitized and truncated separately from the prefix. | ||
|
|
||
| Preserving the UUID prevents two findings with long, identical prefixes from | ||
| being truncated to the same filename and overwriting each other. Sanitizing | ||
| path separators and `..` prevents target-controlled values from escaping the | ||
| configured report directory. | ||
|
|
||
| ## Verification | ||
|
|
||
| The Markdown exporter tests cover: | ||
|
|
||
| - matcher-only and extractor-only filenames; | ||
| - matcher precedence when both operator names are present; | ||
| - UUID and operator suffix preservation for long names; | ||
| - UTF-8-safe truncation; and | ||
| - containment of filenames and sort-mode subdirectories within the report | ||
| directory. | ||
|
|
||
| Run the tests with: | ||
|
|
||
| ```console | ||
| go test ./pkg/reporting/exporters/markdown | ||
| ``` |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| # Markdown and security change report | ||
|
|
||
| This file is a standalone, downloadable summary of the Markdown report filename | ||
| hardening and Go vulnerability remediation work. | ||
|
|
||
| ## Executive summary | ||
|
|
||
| The change set: | ||
|
|
||
| - prevents Markdown report paths from being influenced by directory traversal | ||
| sequences; | ||
| - prevents long template IDs and hosts from removing the per-finding UUID; | ||
| - includes the selected matcher or extractor name in result filenames; | ||
| - truncates filenames without producing invalid UTF-8; | ||
| - updates the Go toolchain and vulnerable dependencies; and | ||
| - reduces reachable `govulncheck` findings from 23 to one upstream advisory | ||
| with no fixed dependency version. | ||
|
|
||
| ## Markdown filename hardening | ||
|
|
||
| Markdown finding files use this structure: | ||
|
|
||
| ```text | ||
| <template-id>-<host>-<uuid>-<matcher-or-extractor>.md | ||
| ``` | ||
|
|
||
| The matcher name is selected when both a matcher and extractor name are | ||
| available. Extractor-only findings use the extractor name. | ||
|
|
||
| Before a file is written, unsafe filesystem characters, path separators, and | ||
| parent-directory references are replaced. The resulting filename is limited to | ||
| 255 bytes and truncated only at a valid UTF-8 boundary. Prefix truncation does | ||
| not remove the UUID or `.md` extension, so findings cannot collide merely | ||
| because their long template and host prefixes are identical. | ||
|
|
||
| ## Dependency remediation | ||
|
|
||
| | Component | Previous version | Updated version | | ||
| | --- | --- | --- | | ||
| | Go toolchain | 1.26.0 | 1.26.5 | | ||
| | `golang.org/x/text` | v0.38.0 | v0.39.0 | | ||
| | `github.com/yuin/goldmark` | v1.7.13 | v1.7.17 | | ||
| | Direct `github.com/google/go-github` use | v30.1.0 | v81.0.0 | | ||
|
|
||
| The direct GitHub client migration covers the custom-template downloader and | ||
| GitHub reporting tracker. Module metadata was refreshed after the upgrades. | ||
|
|
||
| ## Vulnerability scan result | ||
|
|
||
| The initial source scan reported 23 reachable vulnerabilities. After the | ||
| updates, the scan reports only GO-2026-5932. | ||
|
|
||
| GO-2026-5932 remains reachable through the latest available | ||
| `github.com/projectdiscovery/utils/update` dependency, which transitively uses | ||
| `github.com/google/go-github/v30` and `golang.org/x/crypto/openpgp`. The advisory | ||
| does not identify a fixed `golang.org/x/crypto` release. Eliminating this final | ||
| result requires the upstream update package to migrate away from the older | ||
| GitHub client or a replacement of that update subsystem. | ||
|
|
||
| Run the vulnerability scan with: | ||
|
|
||
| ```console | ||
| go run golang.org/x/vuln/cmd/govulncheck@latest \ | ||
| -db=https://storage.googleapis.com/go-vulndb ./... | ||
| ``` | ||
|
|
||
| An exit status indicating GO-2026-5932 is expected until the upstream | ||
| dependency is migrated. | ||
|
|
||
| ## Validation commands | ||
|
|
||
| ```console | ||
| go mod verify | ||
| go test ./pkg/reporting/exporters/markdown | ||
| go test ./pkg/external/customtemplates -run '^$' | ||
| go test ./pkg/reporting/trackers/github | ||
| go vet ./pkg/external/customtemplates \ | ||
| ./pkg/reporting/trackers/github \ | ||
| ./pkg/reporting/exporters/markdown | ||
| ``` | ||
|
|
||
| The `-run '^$'` custom-template command checks compilation without running the | ||
| network-dependent GitHub download tests. | ||
|
|
||
| ## Detailed documentation | ||
|
|
||
| - [Markdown report filenames](markdown-report-filenames.md) | ||
| - [Go vulnerability remediation](security-remediation.md) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| # Go vulnerability remediation | ||
|
|
||
| ## Scope | ||
|
|
||
| A `govulncheck` source scan was performed for all Go packages. The initial scan | ||
| reported 23 reachable vulnerabilities in the Go standard library and direct or | ||
| transitive dependencies. | ||
|
|
||
| The remediation updates the following components: | ||
|
|
||
| | Component | Previous | Remediated | Purpose | | ||
| | --- | --- | --- | --- | | ||
| | Go toolchain | 1.26.0 | 1.26.5 | Includes standard-library security fixes | | ||
| | `golang.org/x/text` | v0.38.0 | v0.39.0 | Fixes GO-2026-5970 | | ||
| | `github.com/yuin/goldmark` | v1.7.13 | v1.7.17 | Fixes GO-2026-5320 | | ||
| | `github.com/google/go-github` (direct use) | v30.1.0 | v81.0.0 | Removes Nuclei's direct dependency path through the deprecated OpenPGP API | | ||
|
|
||
| The GitHub client migration applies to the custom-template downloader and the | ||
| GitHub reporting tracker. | ||
|
|
||
| ## Verification command | ||
|
|
||
| The default Go vulnerability database endpoint may be unavailable in restricted | ||
| environments. The equivalent Google Cloud Storage database mirror can be used: | ||
|
|
||
| ```console | ||
| go run golang.org/x/vuln/cmd/govulncheck@latest \ | ||
| -db=https://storage.googleapis.com/go-vulndb ./... | ||
| ``` | ||
|
|
||
| After remediation, the scan reports one reachable advisory instead of 23. | ||
|
|
||
| ## Remaining upstream advisory | ||
|
|
||
| GO-2026-5932 remains reachable through | ||
| `github.com/projectdiscovery/utils/update`, which transitively depends on | ||
| `github.com/google/go-github/v30` and its use of | ||
| `golang.org/x/crypto/openpgp`. | ||
|
|
||
| The advisory describes the OpenPGP package as unmaintained and unsafe by | ||
| design, and the Go vulnerability database does not provide a fixed | ||
| `golang.org/x/crypto` version. Nuclei already uses `go-github/v81` for its own | ||
| GitHub API integrations, but the older module remains in the dependency graph | ||
| until `projectdiscovery/utils` migrates its update package. | ||
|
|
||
| The remaining advisory therefore cannot be resolved by upgrading | ||
| `golang.org/x/crypto`. It requires an upstream dependency migration or a local | ||
| replacement of the update subsystem. | ||
|
|
||
| ## Validation | ||
|
|
||
| Use the following checks when changing these dependencies: | ||
|
|
||
| ```console | ||
| go mod verify | ||
| go vet ./pkg/external/customtemplates \ | ||
| ./pkg/reporting/trackers/github \ | ||
| ./pkg/reporting/exporters/markdown | ||
| go test ./pkg/external/customtemplates -run '^$' | ||
| go test ./pkg/reporting/trackers/github \ | ||
| ./pkg/reporting/exporters/markdown | ||
| ``` | ||
|
|
||
| The custom-template package has tests that access external GitHub resources. | ||
| Using `-run '^$'` performs a compilation check without requiring network access. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.