fix(workflow): propagate context to child & race steps

[dwisiswant0]

Proposed changes

Workflow inputs get updated with extracted values,
but later executors don't refresh their template
contexts from that state. Child subtemplates reuse
the same input object, letting sibling state leak
across concurrent executions. HTTP race requests
also ignore dynamic values when building requests.

Fix this by syncing the current workflow input
into each executor's template context, cloning
inputs passed to subtemplates, and forwarding
dynamic values to race request generation.

Fixes #5399

Proof

dev:

$ git cherry-pick 3e996ebc
[dev b4a13141] test(workflow): added unit tests for parent-to-child
 Date: Fri May 8 02:59:10 2026 +0700
 5 files changed, 226 insertions(+), 3 deletions(-)
 create mode 100644 internal/tests/integration/testdata/workflow/race-context-share-template-1.yaml
 create mode 100644 internal/tests/integration/testdata/workflow/race-context-share-template-2.yaml
 create mode 100644 internal/tests/integration/testdata/workflow/race-context-share-workflow.yaml
$ go test -v -run "^TestWorkflowsS(ubtemplates(PropagateParentContextToChildTemplateCtx|DoNotShareSiblingContext)|ameStepExecutersRefreshTemplateContext)$" ./pkg/core
=== RUN   TestWorkflowsSubtemplatesPropagateParentContextToChildTemplateCtx
    workflow_execute_test.go:211: 
        	Error Trace:	/home/dw1/Development/PD/nuclei/pkg/core/workflow_execute_test.go:211
        	Error:      	Not equal: 
        	            	expected: string("foo")
        	            	actual  : <nil>(<nil>)
        	Test:       	TestWorkflowsSubtemplatesPropagateParentContextToChildTemplateCtx
        	Messages:   	could not inherit workflow context into child template context
--- FAIL: TestWorkflowsSubtemplatesPropagateParentContextToChildTemplateCtx (0.00s)
=== RUN   TestWorkflowsSubtemplatesDoNotShareSiblingContext
    workflow_execute_test.go:259: 
        	Error Trace:	/home/dw1/Development/PD/nuclei/pkg/core/workflow_execute_test.go:259
        	Error:      	Should be false
        	Test:       	TestWorkflowsSubtemplatesDoNotShareSiblingContext
        	Messages:   	sibling subtemplate inherited workflow context from another sibling
--- FAIL: TestWorkflowsSubtemplatesDoNotShareSiblingContext (0.00s)
=== RUN   TestWorkflowsSameStepExecutersRefreshTemplateContext
    workflow_execute_test.go:301: 
        	Error Trace:	/home/dw1/Development/PD/nuclei/pkg/core/workflow_execute_test.go:301
        	Error:      	Not equal: 
        	            	expected: string("foo")
        	            	actual  : <nil>(<nil>)
        	Test:       	TestWorkflowsSameStepExecutersRefreshTemplateContext
        	Messages:   	could not refresh workflow context into later executers in the same step
--- FAIL: TestWorkflowsSameStepExecutersRefreshTemplateContext (0.00s)
FAIL
FAIL	github.com/projectdiscovery/nuclei/v3/pkg/core	0.099s
FAIL

patch:

$ go test -v -run "^TestWorkflowsS(ubtemplates(PropagateParentContextToChildTemplateCtx|DoNotShareSiblingContext)|ameStepExecutersRefreshTemplateContext)$" ./pkg/core
=== RUN   TestWorkflowsSubtemplatesPropagateParentContextToChildTemplateCtx
--- PASS: TestWorkflowsSubtemplatesPropagateParentContextToChildTemplateCtx (0.00s)
=== RUN   TestWorkflowsSubtemplatesDoNotShareSiblingContext
--- PASS: TestWorkflowsSubtemplatesDoNotShareSiblingContext (0.00s)
=== RUN   TestWorkflowsSameStepExecutersRefreshTemplateContext
--- PASS: TestWorkflowsSameStepExecutersRefreshTemplateContext (0.00s)
PASS
ok  	github.com/projectdiscovery/nuclei/v3/pkg/core	0.084s

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Summary by CodeRabbit

Release Notes

• New Features

  • Improved workflow context propagation—values from parent templates are now properly available in child template execution contexts.
  • Race-condition requests now consistently apply dynamic values.

• Tests

  • Added integration test for workflow race context sharing.
  • Expanded test coverage for template context isolation and propagation across workflow subtemplates.

[neo-by-projectdiscovery-dev]

Neo - PR Security Review — Did Not Complete

Warning

Review Did Not Complete

The review process ended without producing a result. This usually means
the agent encountered a transient error mid-run.

To retry: Push a new commit or comment @pdneo review

_{Comment @pdneo help for available commands.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7871b08a-7bf3-459a-be9c-c891cdcc0ec3

📥 Commits

Reviewing files that changed from the base of the PR and between 1f8dd03 and 805bcfe.

⛔ Files ignored due to path filters (3)

• internal/tests/integration/testdata/workflow/race-context-share-template-1.yaml is excluded by !**/*.yaml
• internal/tests/integration/testdata/workflow/race-context-share-template-2.yaml is excluded by !**/*.yaml
• internal/tests/integration/testdata/workflow/race-context-share-workflow.yaml is excluded by !**/*.yaml

📒 Files selected for processing (4)

• internal/tests/integration/workflow_test.go
• pkg/core/workflow_execute.go
• pkg/core/workflow_execute_test.go
• pkg/protocols/http/request.go

---

Walkthrough

This PR fixes context propagation for race condition templates in workflows. It adds input synchronization before template execution, clones inputs for concurrent subtemplates to prevent state sharing, ensures dynamic values flow through race request generation, and validates the behavior with comprehensive tests.

Changes

Workflow Race Condition Context Propagation

Layer / File(s)	Summary
Workflow Input Context Synchronization pkg/core/workflow_execute.go	New syncWorkflowInputToTemplateCtx method merges workflow-level extracted values into each template's execution context before execution, called for both matcher-less and matcher-based paths in runWorkflowStep.
Input Cloning for Concurrent Safety pkg/core/workflow_execute.go	Subtemplate goroutines now clone the scan context input via ctx.Input.Clone() instead of sharing the input object, preventing concurrent modifications across goroutines.
HTTP Race Request Dynamic Values pkg/protocols/http/request.go	executeRaceRequest method signature updated to accept dynamicValues parameter; both request dumping and race request pre-generation now use dynamic values instead of nil.
Mock Executer Test Infrastructure pkg/core/workflow_execute_test.go	mockExecuter struct extended with executeScanHook callback; Execute and ExecuteWithResults methods updated to invoke the hook, enabling tests to inspect template context from scan contexts.
Context Propagation Unit Tests pkg/core/workflow_execute_test.go	Three new tests validate parent-to-child context propagation, sibling context isolation, and per-step context refresh behavior in workflow execution.
Integration Test internal/tests/integration/workflow_test.go	New workflowRaceContextShare test case runs a workflow where extracted values from a parent template are verified to appear in the request bodies of race-condition subtemplates.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Poem

A race condition once broke the flow,
Context lost in the async know,
But now with clones and sync so tight,
Extracted values travel right! 🐰✨
Sibling threads stay pure and free,
Workflow magic—as it should be! 🎯

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main fix: propagating workflow context (extracted values) to child templates and race condition steps.
Linked Issues check	✅ Passed	The PR addresses issue #5399 by synchronizing workflow input into executor contexts, cloning inputs for subtemplates to prevent sibling leakage, and forwarding dynamic values to race request generation—all required to fix extracted value propagation in race-condition workflows.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing context propagation in workflows: test additions validate the fix, workflow execution logic synchronizes context, and HTTP race request generation now uses dynamic values.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dwisiswant0/fix/workflow/propagate-context-to-child-race-steps

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}