fix(http/raw): persist QueryAuthStrategy params in ApplyAuthStrategy

[akhilesharora]

Proposed changes

Closes #7409

Request.ApplyAuthStrategy in pkg/protocols/http/raw/raw.go parses r.FullURL into a local parsed, appends the QueryAuthStrategy params to parsed.Params, then returns without writing the result back. Every other branch of the switch (CookiesAuthStrategy, HeadersAuthStrategy, BearerTokenAuthStrategy, BasicAuthStrategy) mutates r.Headers. The standalone QueryAuthStrategy.Apply and ApplyOnRR in pkg/authprovider/authx/query_auth.go both write back to req.URL.RawQuery. Only the raw-request path was missing the write-back, so raw templates that match a query auth secret silently drop the params and the request goes out unauthenticated.

Adding r.FullURL = parsed.String() after the params loop fixes it. New unit test in raw_test.go fails on dev and passes with the fix.

$ go test -v -run TestApplyAuthStrategy_QueryAuth_PersistsParams ./pkg/protocols/http/raw/...
=== RUN   TestApplyAuthStrategy_QueryAuth_PersistsParams
--- PASS: TestApplyAuthStrategy_QueryAuth_PersistsParams (0.00s)
PASS
ok  	github.com/projectdiscovery/nuclei/v3/pkg/protocols/http/raw	0.058s

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Summary by CodeRabbit

• Bug Fixes

  • Fixed an issue where authentication query parameters were not being persisted to the full request URL, ensuring credentials in auth strategies are correctly included in outgoing HTTP requests.

• Tests

  • Added coverage to validate query param persistence and preservation, no-op behavior for absent strategies, handling of invalid URLs, and auth behaviors for cookies, headers, bearer tokens, and basic auth.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: deafea04-f900-4e37-b240-63f97352bb8a

📥 Commits

Reviewing files that changed from the base of the PR and between 33066e8 and d68a5ea.

📒 Files selected for processing (1)

• pkg/protocols/http/raw/raw_test.go

---

Walkthrough

ApplyAuthStrategy's QueryAuthStrategy branch now writes the updated URL (with appended query auth params) back into Request.FullURL. A set of unit tests was added to verify query param persistence, preservation of existing params, invalid-URL behavior, nil-strategy no-op, cookies, headers, bearer token, and basic auth handling.

Changes

Query Auth Parameter Persistence + Tests

Layer / File(s)	Summary
Persist query params in ApplyAuthStrategy pkg/protocols/http/raw/raw.go	Assigns parsed.String() back to r.FullURL after adding query auth params in the QueryAuthStrategy branch.
ApplyAuthStrategy unit tests pkg/protocols/http/raw/raw_test.go	Adds tests: TestApplyAuthStrategy_QueryAuth_PersistsParams, ..._PreservesExistingParams, ..._InvalidURLLeavesFullURLUnchanged, ..._NilStrategyIsNoOp, ..._CookiesAuth, ..._HeadersAuth, ..._BearerTokenAuth, ..._BasicAuth validating query, cookie, header, bearer, and basic auth behaviors.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A little bug hid a query's ink,
I nudged one line — no more to sink.
Tests hop in rows, checking each part,
Cookies, headers, tokens, and base64 heart.
A tiny fix, now whole and smart.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and specifically describes the main change: fixing the QueryAuthStrategy to persist modified query parameters in r.FullURL within the ApplyAuthStrategy method.
Linked Issues check	✅ Passed	The pull request fully addresses issue #7409 by adding r.FullURL = parsed.String() after appending query params in ApplyAuthStrategy and includes comprehensive unit tests validating query param persistence.
Out of Scope Changes check	✅ Passed	All changes are directly within scope: the one-line fix in raw.go addresses the missing write-back, and the test file additions comprehensively validate the fix and related auth strategy behaviors without extraneous modifications.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}