panic: assignment to entry in nil map

[gnuletik]

Nuclei version: v3.1.10

Current Behavior:

Nuclei panic with the following stacktrace:

/go/pkg/mod/[github.com/projectdiscovery/nuclei/v3@v3.1.10/pkg/protocols/http/request.go:155](http://github.com/projectdiscovery/nuclei/v3@v3.1.10/pkg/protocols/http/request.go:155) +0x111
created by [github.com/projectdiscovery/nuclei/v3/pkg/protocols/http](http://github.com/projectdiscovery/nuclei/v3/pkg/protocols/http).(*Request).executeParallelHTTP in goroutine 28259
/go/pkg/mod/[github.com/projectdiscovery/nuclei/v3@v3.1.10/pkg/protocols/http/request.go:161](http://github.com/projectdiscovery/nuclei/v3@v3.1.10/pkg/protocols/http/request.go:161) +0x138
[github.com/projectdiscovery/nuclei/v3/pkg/protocols/http](http://github.com/projectdiscovery/nuclei/v3/pkg/protocols/http).(*Request).executeParallelHTTP.func1(0xc003a05a40)
/go/pkg/mod/[github.com/projectdiscovery/nuclei/v3@v3.1.10/pkg/protocols/http/request.go:732](http://github.com/projectdiscovery/nuclei/v3@v3.1.10/pkg/protocols/http/request.go:732) +0x1f97
[github.com/projectdiscovery/nuclei/v3/pkg/protocols/http](http://github.com/projectdiscovery/nuclei/v3/pkg/protocols/http).(*Request).executeRequest(0xc002c49c00, 0xc0053b32f0, 0xc003a05a40, 0xc005917f78, 0x0, 0xc004e8a0c0, 0x0)
/go/pkg/mod/[github.com/projectdiscovery/nuclei/v3@v3.1.10/pkg/protocols/http/httputils/chain.go:119](http://github.com/projectdiscovery/nuclei/v3@v3.1.10/pkg/protocols/http/httputils/chain.go:119) +0xde
[github.com/projectdiscovery/nuclei/v3/pkg/protocols/http/httputils](http://github.com/projectdiscovery/nuclei/v3/pkg/protocols/http/httputils).(*ResponseChain).Fill(0xc004e74bd0)
/go/pkg/mod/[github.com/projectdiscovery/nuclei/v3@v3.1.10/pkg/protocols/http/httputils/normalization.go:44](http://github.com/projectdiscovery/nuclei/v3@v3.1.10/pkg/protocols/http/httputils/normalization.go:44) +0x27e
[github.com/projectdiscovery/nuclei/v3/pkg/protocols/http/httputils.readNNormalizeRespBody](http://github.com/projectdiscovery/nuclei/v3/pkg/protocols/http/httputils.readNNormalizeRespBody)(0xc005f2cf30?, 0xc00a2ff6b0)
/usr/local/go/src/net/http/header.go:40
net/http.Header.Set(...)
/usr/local/go/src/net/textproto/header.go:22
net/textproto.MIMEHeader.Set(...)
goroutine 28260 [running]:
panic: assignment to entry in nil map

[olearycrew]

@gnuletik can you share what command or templates you were using when you got this error?

[gnuletik]

Hello @olearycrew, thanks for looking into it!

I was running Nuclei as a library with go 1.22.
I was using the https://github.com/projectdiscovery/nuclei-templates repository for templates but I don't know which template was used exactly.

I checked the error a bit and here are the stacktrace references:

• https://cs.opensource.google/go/go/+/refs/tags/go1.22.0:src/net/textproto/header.go;l=21
• https://cs.opensource.google/go/go/+/refs/tags/go1.22.0:src/net/http/header.go;l=39

• nuclei/pkg/protocols/http/httputils/normalization.go

  Line 44 in 2cbc21e

  response.Header.Set("x-nuclei-ignore-error", err.Error())

So, it seems that in the readNNormalizeRespBody function, the value response.Header is assumed to be not nil if the connection is closed.
However, it seems to be nil in my usecase.

It seems to have been introduced in this PR:
https://github.com/projectdiscovery/nuclei/pull/4680/files#diff-c75f570fd0811fe8bef8f79727937131c004c32767ca6f79af27c3d8158dc001

Maybe @tarunKoyalwar (who opened the PR) know why this check was needed / how this could be fixed?

Thanks!

[tarunKoyalwar]

@gnuletik, yeah looks like headers are nil , i will raise a PR for this shortly