nuclei/pkg/protocols/network/operators.go

package network

import (
	"time"

	"github.com/projectdiscovery/nuclei/v3/pkg/model"
	"github.com/projectdiscovery/nuclei/v3/pkg/operators"
	"github.com/projectdiscovery/nuclei/v3/pkg/operators/extractors"
	"github.com/projectdiscovery/nuclei/v3/pkg/operators/matchers"
	"github.com/projectdiscovery/nuclei/v3/pkg/output"
	"github.com/projectdiscovery/nuclei/v3/pkg/protocols"
	protocolutils "github.com/projectdiscovery/nuclei/v3/pkg/protocols/utils"
	"github.com/projectdiscovery/nuclei/v3/pkg/types"
)

// Match matches a generic data response again a given matcher
func (request *Request) Match(data map[string]interface{}, matcher *matchers.Matcher) (bool, []string) {
	itemStr, ok := request.getMatchPart(matcher.Part, data)
	if !ok && matcher.Type.MatcherType != matchers.DSLMatcher {
		return false, []string{}
	}

	switch matcher.GetType() {
	case matchers.SizeMatcher:
		return matcher.Result(matcher.MatchSize(len(itemStr))), []string{}
	case matchers.WordsMatcher:
		return matcher.ResultWithMatchedSnippet(matcher.MatchWords(itemStr, data))
	case matchers.RegexMatcher:
		return matcher.ResultWithMatchedSnippet(matcher.MatchRegex(itemStr))
	case matchers.BinaryMatcher:
		return matcher.ResultWithMatchedSnippet(matcher.MatchBinary(itemStr))
	case matchers.DSLMatcher:
		return matcher.Result(matcher.MatchDSL(data)), []string{}
	case matchers.XPathMatcher:
		return matcher.Result(matcher.MatchXPath(itemStr)), []string{}
	}
	return false, []string{}
}

// Extract performs extracting operation for an extractor on model and returns true or false.
func (request *Request) Extract(data map[string]interface{}, extractor *extractors.Extractor) map[string]struct{} {
	itemStr, ok := request.getMatchPart(extractor.Part, data)
	if !ok && !extractors.SupportsMap(extractor) {
		return nil
	}

	switch extractor.GetType() {
	case extractors.RegexExtractor:
		return extractor.ExtractRegex(itemStr)
	case extractors.KValExtractor:
		return extractor.ExtractKval(data)
	case extractors.DSLExtractor:
		return extractor.ExtractDSL(data)
	}
	return nil
}

func (request *Request) getMatchPart(part string, data output.InternalEvent) (string, bool) {
	switch part {
	case "body", "all", "":
		part = "data"
	}

	item, ok := data[part]
	if !ok {
		return "", false
	}
	itemStr := types.ToString(item)

	return itemStr, true
}

// responseToDSLMap converts a network response to a map for use in DSL matching
func (request *Request) responseToDSLMap(req, resp, raw, host, matched string) output.InternalEvent {
	return output.InternalEvent{
		"host":          host,
		"matched":       matched,
		"request":       req,
		"data":          resp, // Data is the last bytes read
		"raw":           raw,  // Raw is the full transaction data for network
		"type":          request.Type().String(),
		"template-id":   request.options.TemplateID,
		"template-info": request.options.TemplateInfo,
		"template-path": request.options.TemplatePath,
	}
}

// MakeResultEvent creates a result event from internal wrapped event
func (request *Request) MakeResultEvent(wrapped *output.InternalWrappedEvent) []*output.ResultEvent {
	return protocols.MakeDefaultResultEvent(request, wrapped)
}

func (request *Request) GetCompiledOperators() []*operators.Operators {
	return []*operators.Operators{request.CompiledOperators}
}

func (request *Request) MakeResultEventItem(wrapped *output.InternalWrappedEvent) *output.ResultEvent {
	fields := protocolutils.GetJsonFieldsFromURL(types.ToString(wrapped.InternalEvent["host"]))
	if types.ToString(wrapped.InternalEvent["ip"]) != "" {
		fields.Ip = types.ToString(wrapped.InternalEvent["ip"])
	}
	
	var isGlobalMatchers bool
	if value, ok := wrapped.InternalEvent["global-matchers"]; ok {
		isGlobalMatchers = value.(bool)
	}
	
	// For global matchers, use original template info and store global template info separately
	var templateID, templatePath string
	var templateInfo model.Info
	var globalTemplateID, globalTemplatePath string
	var globalTemplateInfo model.Info
	
	if isGlobalMatchers {
		// Use original template information
		templateID = types.ToString(wrapped.InternalEvent["origin-template-id"])
		templatePath = types.ToString(wrapped.InternalEvent["origin-template-path"])
		if originInfo := wrapped.InternalEvent["origin-template-info"]; originInfo != nil {
			templateInfo = originInfo.(model.Info)
		}
		// Store global template information
		globalTemplateID = types.ToString(wrapped.InternalEvent["template-id"])
		globalTemplatePath = types.ToString(wrapped.InternalEvent["template-path"])
		if globalInfo := wrapped.InternalEvent["template-info"]; globalInfo != nil {
			globalTemplateInfo = globalInfo.(model.Info)
		}
	} else {
		// Use current template information for non-global matchers
		templateID = types.ToString(wrapped.InternalEvent["template-id"])
		templatePath = types.ToString(wrapped.InternalEvent["template-path"])
		templateInfo = wrapped.InternalEvent["template-info"].(model.Info)
	}
	
	data := &output.ResultEvent{
		TemplateID:         templateID,
		TemplatePath:       templatePath,
		Info:               templateInfo,
		TemplateVerifier:   request.options.TemplateVerifier,
		Type:               types.ToString(wrapped.InternalEvent["type"]),
		Host:               fields.Host,
		Port:               fields.Port,
		URL:                fields.URL,
		Matched:            types.ToString(wrapped.InternalEvent["matched"]),
		ExtractedResults:   wrapped.OperatorsResult.OutputExtracts,
		Metadata:           wrapped.OperatorsResult.PayloadValues,
		Timestamp:          time.Now(),
		MatcherStatus:      true,
		IP:                 fields.Ip,
		GlobalMatchers:     isGlobalMatchers,
		GlobalTemplateID:   globalTemplateID,
		GlobalTemplatePath: globalTemplatePath,
		GlobalTemplateInfo: globalTemplateInfo,
		Request:            types.ToString(wrapped.InternalEvent["request"]),
		Response:           types.ToString(wrapped.InternalEvent["data"]),
		TemplateEncoded:    request.options.EncodeTemplate(),
		Error:              types.ToString(wrapped.InternalEvent["error"]),
	}
	return data
}