fix(interactsh): serialize InternalEvent access

pkg/protocols/common/interactsh/interactsh.go

@@ -119,7 +119,7 @@ func (c *Client) poll() error {
 		}
 
 		if requestShouldStopAtFirstMatch(request) || c.options.StopAtFirstMatch {
-			if gotItem, err := c.matchedTemplates.Get(hash(request.Event.InternalEvent)); gotItem && err == nil {
+			if gotItem, err := c.matchedTemplates.Get(eventHash(request.Event)); gotItem && err == nil {
 				return
 			}
 		}
@@ -154,6 +154,7 @@ func requestShouldStopAtFirstMatch(request *RequestData) bool {
 func (c *Client) processInteractionForRequest(interaction *server.Interaction, data *RequestData) bool {
 	var result *operators.Result
 	var matched bool
+	var templateID string
 	data.Event.Lock()
 	data.Event.InternalEvent["interactsh_protocol"] = interaction.Protocol
 	if strings.EqualFold(interaction.Protocol, "dns") {
@@ -163,16 +164,16 @@ func (c *Client) processInteractionForRequest(interaction *server.Interaction, d
 	}
 	data.Event.InternalEvent["interactsh_response"] = interaction.RawResponse
 	data.Event.InternalEvent["interactsh_ip"] = interaction.RemoteAddress
-	data.Event.Unlock()
-
 	if data.Operators != nil {
 		result, matched = data.Operators.Execute(data.Event.InternalEvent, data.MatchFunc, data.ExtractFunc, c.options.Debug || c.options.DebugRequest || c.options.DebugResponse)
 	} else {
 		// this is most likely a bug so error instead of warning
-		var templateID string
 		if data.Event.InternalEvent != nil {
 			templateID = fmt.Sprint(data.Event.InternalEvent[templateIdAttribute])
 		}
+	}
+	data.Event.Unlock()
+	if data.Operators == nil {
 		gologger.Error().Msgf("missing compiled operators for '%v' template", templateID)
 	}
 
@@ -225,18 +226,15 @@ func (c *Client) processInteractionForRequest(interaction *server.Interaction, d
 		data.Event.InteractshMatched.Store(true)
 		c.matched.Store(true)
 		if requestShouldStopAtFirstMatch(data) || c.options.StopAtFirstMatch {
-			_ = c.matchedTemplates.SetWithExpire(hash(data.Event.InternalEvent), true, defaultInteractionDuration)
+			_ = c.matchedTemplates.SetWithExpire(eventHash(data.Event), true, defaultInteractionDuration)
 		}
 	}
 
 	return true
 }
 
 func (c *Client) AlreadyMatched(data *RequestData) bool {
-	data.Event.RLock()
-	defer data.Event.RUnlock()
-
-	return c.matchedTemplates.Has(hash(data.Event.InternalEvent))
+	return c.matchedTemplates.Has(eventHash(data.Event))
 }
 
 // URL returns a new URL that can be interacted with
@@ -348,7 +346,7 @@ func (c *Client) RequestEvent(interactshURLs []string, data *RequestData) {
 		id := strings.TrimRight(strings.TrimSuffix(interactshURL, c.getHostname()), ".")
 
 		if requestShouldStopAtFirstMatch(data) || c.options.StopAtFirstMatch {
-			gotItem, err := c.matchedTemplates.Get(hash(data.Event.InternalEvent))
+			gotItem, err := c.matchedTemplates.Get(eventHash(data.Event))
 			if gotItem && err == nil {
 				break
 			}
@@ -450,6 +448,13 @@ func hash(internalEvent output.InternalEvent) string {
 	return fmt.Sprintf("%s:%s", templateId, host)
 }
 
+func eventHash(event *output.InternalWrappedEvent) string {
+	event.RLock()
+	defer event.RUnlock()
+
+	return hash(event.InternalEvent)
+}
+
 func (c *Client) getHostname() string {
 	c.RLock()
 	defer c.RUnlock()

pkg/protocols/common/interactsh/interactsh_test.go

@@ -0,0 +1,94 @@
+package interactsh
+
+import (
+	"fmt"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+
+	serverint "github.com/projectdiscovery/interactsh/pkg/server"
+	"github.com/projectdiscovery/nuclei/v3/pkg/operators"
+	"github.com/projectdiscovery/nuclei/v3/pkg/operators/extractors"
+	"github.com/projectdiscovery/nuclei/v3/pkg/operators/matchers"
+	"github.com/projectdiscovery/nuclei/v3/pkg/output"
+	"github.com/stretchr/testify/require"
+)
+
+func TestProcessInteractionForRequestConcurrentEventUpdate(t *testing.T) {
+	const (
+		keyCount        = 4096
+		expressionCount = 256
+		mutationCount   = keyCount * 200
+	)
+
+	eventData := make(output.InternalEvent, keyCount+2)
+	eventData[templateIdAttribute] = "test-template"
+	eventData["host"] = "example.com"
+
+	var expressionBuilder strings.Builder
+	for i := 0; i < keyCount; i++ {
+		key := fmt.Sprintf("key%d", i)
+		eventData[key] = fmt.Sprintf("value%d", i)
+		if i < expressionCount {
+			expressionBuilder.WriteString("{{")
+			expressionBuilder.WriteString(key)
+			expressionBuilder.WriteString("}}")
+		}
+	}
+
+	matcher := &matchers.Matcher{
+		Type:  matchers.MatcherTypeHolder{MatcherType: matchers.WordsMatcher},
+		Words: []string{expressionBuilder.String()},
+	}
+	op := &operators.Operators{
+		Matchers:          []*matchers.Matcher{matcher},
+		MatchersCondition: "or",
+	}
+	require.NoError(t, op.Compile())
+
+	var startWriter sync.Once
+	writerStarted := make(chan struct{})
+	requestData := &RequestData{
+		Event:     &output.InternalWrappedEvent{InternalEvent: eventData},
+		Operators: op,
+		MatchFunc: func(data map[string]interface{}, matcher *matchers.Matcher) (bool, []string) {
+			startWriter.Do(func() {
+				close(writerStarted)
+			})
+			runtime.Gosched()
+			return matcher.MatchWords("not-present-in-corpus", data)
+		},
+		ExtractFunc: func(map[string]interface{}, *extractors.Extractor) map[string]struct{} {
+			return nil
+		},
+	}
+
+	var writerWG sync.WaitGroup
+	writerWG.Add(1)
+	go func() {
+		defer writerWG.Done()
+		<-writerStarted
+		for i := 0; i < mutationCount; i++ {
+			key := fmt.Sprintf("key%d", i%keyCount)
+			requestData.Event.Lock()
+			requestData.Event.InternalEvent[key] = fmt.Sprintf("mutated-%d", i)
+			if i%17 == 0 {
+				delete(requestData.Event.InternalEvent, key)
+				requestData.Event.InternalEvent[key] = fmt.Sprintf("mutated-%d", i)
+			}
+			requestData.Event.Unlock()
+		}
+	}()
+
+	client := &Client{options: &Options{}}
+	matched := client.processInteractionForRequest(&serverint.Interaction{
+		Protocol:      "dns",
+		RawRequest:    "request",
+		RawResponse:   "response",
+		RemoteAddress: "127.0.0.1",
+	}, requestData)
+	writerWG.Wait()
+
+	require.False(t, matched)
+}