Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Purge cache on global callback set #4840

Merged
merged 6 commits into from Mar 10, 2024
Merged

Purge cache on global callback set #4840

merged 6 commits into from Mar 10, 2024

Conversation

Mzack9999
Copy link
Member

@Mzack9999 Mzack9999 commented Mar 6, 2024

Proposed changes

This PR invalidates internal cache in case of global callback settings which are hold as reference inside template executor. The proper solution would be to have a global parsing logic and executor compilation that should happen in ephemeral lazy mode.

Closes #4836

Checklist

  • Pull request is created against the dev branch
  • All checks passed (lint, unit/integration/regression tests etc.) with my changes
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)

Example

go snippet
package main

import (
  "fmt"

  nuclei "github.com/projectdiscovery/nuclei/v3/lib"
  "github.com/projectdiscovery/nuclei/v3/pkg/output"
)

func run() {
  ret := make([]*output.ResultEvent, 0, 10)
  ne, err := nuclei.NewThreadSafeNucleiEngine()
  if err != nil {
  	return
  }
  cb := func(event *output.ResultEvent) {
  	ret = append(ret, event)
  	fmt.Printf("%p, %v\n", ret, ret)
  }
  ne.GlobalResultCallback(cb)

  tf := nuclei.TemplateFilters{IDs: []string{"exposed-redis"}}
  opts := []nuclei.NucleiSDKOptions{
  	nuclei.WithTemplateFilters(tf),
  }
  err = ne.ExecuteNucleiWithOpts([]string{"127.0.0.1:6379"}, opts...)
  if err != nil {
  	fmt.Println("err: ", err)
  }
  ne.Close()
}

func main() {
  for i := 0; i < 5; i++ {
  	run()
  }
}

Start redis:

$ docker run -p 6379:6379 redis/redis-stack-server:latest

Before:

$ go run .
0xc000987d10, [0xc001424fc8]
0xc000987d10, [0xc001424fc8 0xc000a82fc8]
0xc000987d10, [0xc001424fc8 0xc000a82fc8 0xc00979c248]
0xc000987d10, [0xc001424fc8 0xc000a82fc8 0xc00979c248 0xc000a83448]
0xc000987d10, [0xc001424fc8 0xc000a82fc8 0xc00979c248 0xc000a83448 0xc00979c908]

After:

$ go run .
0xc000c8e190, [0xc0009eafc8]
0xc000d84500, [0xc0009eb448]
0xc001004460, [0xc002e1e248]
0xc000c8f310, [0xc002e1eb48]
0xc000c8fa90, [0xc002e1e6c8]

@Mzack9999 Mzack9999 added the Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors. label Mar 6, 2024
@Mzack9999 Mzack9999 self-assigned this Mar 6, 2024
@Mzack9999 Mzack9999 marked this pull request as ready for review March 9, 2024 19:30
@Mzack9999 Mzack9999 requested a review from ehsandeep March 9, 2024 19:43
Copy link
Member

@tarunKoyalwar tarunKoyalwar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm !

Awesome ! looks like we now know why we were still seeing template references even if we take mem profiles at end of execution

@Mzack9999 , along with template cache in templates package , we also have another internal cache in parsers package , included that as well and abstracted global cache register/purge via config

@ehsandeep ehsandeep merged commit ec4fb40 into dev Mar 10, 2024
12 checks passed
@ehsandeep ehsandeep deleted the bugfix-4836-gc branch March 10, 2024 21:29
tarunKoyalwar added a commit that referenced this pull request Mar 10, 2024
* purge cache on global callback set

* lint

* purging cache

* purge cache in runner after loading templates

* include internal cache from parsers + add global cache register/purge via config

* remove disable cache purge option

---------

Co-authored-by: Tarun Koyalwar <tarun@projectdiscovery.io>
@Mzack9999
Copy link
Member Author

I'll open a follow up PR as the design appears to be broken. The global cache should contain only templates in their most abstract and general representation, while the "compilation" should happen lazily and be usable independently by various runners without cross-references.

ehsandeep added a commit that referenced this pull request Mar 13, 2024
* feat: move fuzz package to root directory

* feat: added support for input providers like openapi,postman,etc

* feat: integration of new fuzzing logic in engine

* bugfix: use and instead of or

* fixed lint errors

* go mod tidy

* add new reqresp type + bump utils

* custom http request parser

* use new struct type RequestResponse

* introduce unified input/target provider

* abstract input formats via new inputprovider

* completed input provider refactor

* remove duplicated code

* add sdk method to load targets

* rename component url->path

* add new yaml format + remove duplicated code

* use gopkg.in/yaml.v3 for parsing

* update .gitignore

* refactor/move + docs fuzzing in http protocol

* fuzz: header + query integration test using fuzzplayground

* fix integration test runner in windows

* feat add support for filter in http fuzz

* rewrite header/query integration test with filter

* add replace regex rule

* support kv fuzzing + misc updates

* add path fuzzing example + misc improvements

* fix matchedURL + skip httpx on multi formats

* cookie fuzz integration test

* add json body + params body tests

* feat add multipart/form-data fuzzing support

* add all fuzz body integration test

* misc bug fixes + minor refactor

* add multipart form + body form unit tests

* only run fuzzing templates if -fuzz flag is given

* refactor/move fuzz playground server to pkg

* fix integration test + refactor

* add auth types and strategies

* add file auth provider

* start implementing auth logic in http

* add logic in http protocol

* static auth implemented for http

* default :80,:443 normalization

* feat: dynamic auth init

* feat: dynamic auth using templates

* validate targets count in openapi+swagger

* inputformats: add support to accept variables

* fix workflow integration test

* update lazy cred fetch logic

* fix unit test

* drop postman support

* domain related normalization

* update secrets.yaml file format + misc updates

* add auth prefetch option

* remove old secret files

* add fuzzing+auth related sdk options

* fix/support multiple mode in kv header fuzzing

* rename 'headers' -> 'header' in fuzzing rules

* fix deadlock due to merge conflict resolution

* misc update

* add bool type in parsed value

* add openapi validation+override+ new flags

* misc updates

* remove optional path parameters when unavailable

* fix swagger.yaml file

* misc updates

* update print msg

* multiple openapi validation enchancements + appMode

* add optional params in required_openapi_vars.yaml file

* improve warning/verbose msgs in format

* fix skip-format-validation not working

* use 'params/parameter' instead of 'variable' in openapi

* add retry support for falky tests

* fix nuclei loading ignored templates (#4849)

* fix tag include logic

* fix unit test

* remove quoting in extractor output

* remove quote in debug code command

* feat: issue tracker URLs in JSON + misc fixes (#4855)

* feat: issue tracker URLs in JSON + misc fixes

* misc changes

* feat: status update support for issues

* feat: report metadata generation hook support

* feat: added CLI summary of tickets created

* misc changes

* introduce `disable-unsigned-templates` flag (#4820)

* introduce `disable-unsigned-templates` flag

* minor

* skip instead of exit

* remove duplicate imports

* use stats package + misc enhancements

* force display warning + adjust skipped stats in unsigned count

* include unsigned skipped templates without -dut flag

---------

Co-authored-by: Tarun Koyalwar <tarun@projectdiscovery.io>

* Purge cache on global callback set (#4840)

* purge cache on global callback set

* lint

* purging cache

* purge cache in runner after loading templates

* include internal cache from parsers + add global cache register/purge via config

* remove disable cache purge option

---------

Co-authored-by: Tarun Koyalwar <tarun@projectdiscovery.io>

* misc update

* add application/octet-stream support

* openapi: support path specific params

* misc option + readme update

---------

Co-authored-by: Sandeep Singh <sandeep@projectdiscovery.io>
Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
Co-authored-by: Tarun Koyalwar <tarun@projectdiscovery.io>
Co-authored-by: Tarun Koyalwar <45962551+tarunKoyalwar@users.noreply.github.com>
Co-authored-by: Dogan Can Bakir <65292895+dogancanbakir@users.noreply.github.com>
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

running nuclei with sdk may have gc problem
3 participants