Reporting validation

[mkrs2404]

Proposed changes

Add a validator callback function that will be checked before reporting. This can be used to provide custom checks

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Summary by CodeRabbit

• New Features

  • Added an optional pre-report validation hook to filter events before they are reported. Runs after allow/deny lists and before deduplication/export, enabling finer control over what gets reported.

• Chores

  • Updated underlying dependencies to newer versions for improved stability and compatibility.

[coderabbitai]

Walkthrough

Adds a validation hook to reporting: a new Options.ValidatorCallback field and an early-return check in CreateIssue to skip processing when validation fails. Also updates dependencies in go.mod for httpx and goldmark.

Changes

Cohort / File(s)	Summary
Dependencies bump go.mod	Updated module versions: github.com/projectdiscovery/httpx and indirect github.com/yuin/goldmark.
Reporting options API pkg/reporting/options.go	Added exported field ValidatorCallback func(event *output.ResultEvent) bool (yaml:"-") to Options; imported github.com/projectdiscovery/nuclei/v3/pkg/output.
Reporting flow validation pkg/reporting/reporting.go	In CreateIssue, after allow/deny filtering and before dedupe, invoke options.ValidatorCallback; if set and returns false, return early with nil.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant U as Caller
  participant R as reporting.CreateIssue
  participant F as Allow/Deny Filter
  participant V as ValidatorCallback
  participant D as Dedupe
  participant T as Trackers/Exporters

  U->>R: CreateIssue(event, options)
  R->>F: Apply allow/deny rules
  F-->>R: pass/fail
  alt Filter failed
    R-->>U: return nil
  else Filter passed
    opt New/Changed
      R->>V: options.ValidatorCallback(event)?
      alt Validator returns false
        R-->>U: return nil
      else Validator returns true or unset
        R->>D: Dedupe check
        D-->>R: proceed/skip
        R->>T: Process trackers/exporters
        T-->>R: done
        R-->>U: result
      end
    end
  end

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

I twitch my ears at gates anew,
A tiny hook says, “Only true.”
If checks pass, I bound ahead—
If not, I nap instead.
Dependencies trimmed and neat,
My burrow’s code feels light on feet. 🐇✨

✨ Finishing Touches

• 📝 Generate Docstrings

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch reporting-validation

---

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbitai help to get the list of available commands.

Other keywords and placeholders

• Add @coderabbitai ignore or @coderabbit ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Status, Documentation and Community

• Visit our Status Page to check the current availability of CodeRabbit.
• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

pkg/reporting/options.go (1)

27-28: Tighten the contract in the comment; consider a named type for clarity

Make expectations explicit (thread-safety, performance, no mutation). Optionally introduce a named type to improve discoverability.

Apply comment refinement:

-	// ValidatorCallback is a callback function that is called to validate an event before it is reported
+	// ValidatorCallback validates an event before reporting.
+	// Must be concurrency-safe, fast, and side-effect free (do not mutate event).
+	// Return false to skip reporting of the event.
 	ValidatorCallback func(event *output.ResultEvent) bool `yaml:"-"`

Optional named type (outside this hunk, near the type declarations):

// EventValidator validates a result event prior to reporting.
// Return false to skip reporting.
type EventValidator func(event *output.ResultEvent) bool

Then change the field to:

-	ValidatorCallback func(event *output.ResultEvent) bool `yaml:"-"`
+	ValidatorCallback EventValidator `yaml:"-"`

If you’d like, I can add a small unit test proving the validator is invoked and that rejection short-circuits trackers/exporters.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 32dfeac and 01854c1.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (3)

• go.mod (2 hunks)
• pkg/reporting/options.go (2 hunks)
• pkg/reporting/reporting.go (1 hunks)

🧰 Additional context used

🧬 Code graph analysis (1)

pkg/reporting/options.go (1)

pkg/output/output.go (1)

• ResultEvent (146-221)

🔇 Additional comments (2)

go.mod (1)

355-355: The failure indicates waf.go expects regexes.json under pkg/output/stats/waf/, which isn’t present in the test’s working directory. Update the smoke test to include that fixture or run tests with -testdata prep:

#!/bin/bash
# Ensure required JSON fixture is available
cp pkg/output/stats/waf/regexes.json "$(go env GOPATH)/pkg/mod/github.com/projectdiscovery/nuclei@*/pkg/output/stats/waf/"
go test ./pkg/reporting/exporters/markdown -run Test -v || true

Or better, vendor regexes.json into pkg/reporting/exporters/markdown/testdata/ and reference it via testdata/. Then the original smoke test will pass without setup errors.

pkg/reporting/options.go (1)

4-4: Import addition looks good

Using output.ResultEvent directly here is appropriate and avoids local type duplication.

[coderabbitai]

💡 Verification agent

🧩 Analysis chain

httpx pseudo-version bump — verify build/tidy and compatibility

Looks fine, but please run mod hygiene and confirm no breakages in dependents.

Suggested checks:

---

🏁 Script executed:

#!/bin/bash
# Refresh sums and vendor if used
go mod tidy
# Surface potential API changes
go list -m -json github.com/projectdiscovery/httpx | jq '.Version, .Time'
# Quick compile of reporting pkg (touches Options/CreateIssue paths)
go build ./pkg/reporting/...

Length of output: 20309

---

The directory listing will confirm whether regexes.json is missing in pkg/output/stats/waf. If it’s absent, add the file or adjust the //go:embed pattern accordingly before merging.

🤖 Prompt for AI Agents

In go.mod around line 98, the reviewer notes that builds referencing
pkg/output/stats/waf expect regexes.json to be embedded; verify whether
pkg/output/stats/waf/regexes.json exists in the repo and if missing either add
the file at that path or update the //go:embed pattern in the Go source to match
the actual filename/location (or include a wildcard) so the file is correctly
embedded during build.

[coderabbitai]

💡 Verification agent

🧩 Analysis chain

Harden validator callback against panics and add trace on rejection

A faulty user callback can crash reporting. Wrap it with recover and optionally emit a debug when it rejects.

Apply:

-    if c.options.ValidatorCallback != nil && !c.options.ValidatorCallback(event) {
-        return nil
-    }
+    if v := c.options.ValidatorCallback; v != nil {
+        valid := false
+        func() {
+            defer func() {
+                if r := recover(); r != nil {
+                    gologger.Warning().Msgf("reporting: validator panicked: %v", r)
+                    valid = false
+                }
+            }()
+            valid = v(event)
+        }()
+        if !valid {
+            // rejected by validator; skip reporting
+            // gologger.Debug().Msg("reporting: event rejected by ValidatorCallback")
+            return nil
+        }
+    }

Also, double-check that skipping dedupe on validator rejection is intentional (events will be re-evaluated every run).

---

🏁 Script executed:

#!/bin/bash
file="pkg/reporting/reporting.go"
if [ ! -f "$file" ]; then
  echo "$file not found"
  exit 1
fi

echo "=== Imports ==="
sed -n '1,80p' "$file"

echo "=== Validator snippet context ==="
sed -n '260,330p' "$file"

echo "=== Searching for dedupe in pkg/reporting ==="
grep -R -n "dedupe" pkg/reporting

Length of output: 5797

---

Harden validator callback against panics and add trace on rejection
Wrap the ValidatorCallback invocation in a defer-recover closure to catch panics (logging with gologger.Warning) and emit a debug log on rejection. The current check at lines 291–294 runs before the dedupe.Index call (around line 297), so rejected events are never indexed—confirm that this ordering is intentional, or move the validation below the dedupe step if you need to dedupe even rejected events.

🤖 Prompt for AI Agents

In pkg/reporting/reporting.go around lines 291-294, the ValidatorCallback
invocation should be hardened and its rejection traced: wrap the call in a small
defer/recover so any panic is caught and logged via gologger.Warning with the
recovered error and stack, and when the callback returns false emit a debug log
noting the event was rejected (include identifying info). Also review ordering:
currently the validation runs before the dedupe.Index call at ~297 — either keep
that intentional ordering or move the validated call below the dedupe step if
you must dedupe rejected events; implement the panic protection and debug log
regardless of the final placement.