Function execute

worker/src/components/security/nuclei.ts:326–586

({ inputs, params }, context)

    ],
  },
  async execute({ inputs, params }, context) {
    const parsedInputs = inputSchema.parse(inputs);
    const parsedParams = parameterSchema.parse(params);

    context.logger.info(`[Nuclei] Starting scan for ${parsedInputs.targets.length} target(s)`);

    const tenantId = (context as any).tenantId ?? 'default-tenant';
    let volume: IsolatedContainerVolume | null = null;

    try {
      const hasCustomArchive = !!parsedInputs.customTemplateArchive;
      const hasCustomYaml = !!parsedInputs.customTemplateYaml;
      const hasBuiltInFilters = !!(
        (parsedInputs.templateIds && parsedInputs.templateIds.length > 0) ||
        (parsedInputs.templatePaths && parsedInputs.templatePaths.length > 0)
      );
      const hasSeverityFilter = !!(
        parsedParams.severityFilter && parsedParams.severityFilter.length > 0
      );

      if (!hasCustomArchive && !hasCustomYaml && !hasBuiltInFilters && !hasSeverityFilter) {
        throw new ValidationError(
          'At least one template source is required: customTemplateArchive, customTemplateYaml, templateIds, templatePaths, or severityFilter',
        );
      }

      // ===== TypeScript: Build nuclei command args =====
      const args: string[] = [
        '-duc', // Disable update check (templates pre-installed in image)
        '-jsonl', // JSONL output format (nuclei v3.6.0+)
        '-stream', // Stream mode: prevents buffering, required for PTY compatibility
        '-verbose', // Show findings in terminal (overrides silent mode)
        '-l',
        '/inputs/targets.txt', // Targets file
      ];

      // Conditionally disable httpx probing
      if (parsedParams.disableHttpx) {
        args.push('-nh');
      }

      // Scan configuration
      args.push('-rl', parsedParams.rateLimit.toString());
      args.push('-c', parsedParams.concurrency.toString());
      args.push('-timeout', parsedParams.timeout.toString());
      args.push('-retries', parsedParams.retries.toString());

      if (parsedParams.updateTemplates) {
        args.push('-update-templates');
      }

      if (parsedParams.followRedirects) {
        args.push('-follow-redirects');
      }

      // Severity filter
      if (parsedParams.severityFilter && parsedParams.severityFilter.length > 0) {
        args.push('-s', parsedParams.severityFilter.join(','));