fix(index): limit include-tags to matching tag exclusions

[dwisiswant0]

Proposed changes

IncludeTags in the metadata index was treated as
a forced include, so -itags could bypass
explicit ID/path filters and other include
criteria, while also let a template thru when it
had both an included tag and a different excluded
tag.

Match the parsed-template filter instead: an
included tag only cancels exclusion for that same
tag. Other exclusions and normal include filters
still apply, while IncludeTemplates remains the
explicit path override.

Fixes #7534

Proof

$ $ go test ./pkg/catalog/index -run 'TestFilterMatches/Include_tags' -count=1
ok  	github.com/projectdiscovery/nuclei/v3/pkg/catalog/index	0.127s

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Summary by CodeRabbit

• Bug Fixes
  • Updated catalog template filtering so protocol/type-based exclusions take precedence over normal inclusion.
  • Refined “forced include” behavior: included tags can only restore an excluded tag when they reference the same tag; other exclusions (and unrelated include tags) no longer bypass rules.
  • Kept explicit template path overrides intact.
• Tests
  • Expanded unit test coverage for include/exclude tag interactions across other filtering dimensions.
  • Skipped a specific functional test case until the next nuclei release, citing intentional load-count differences.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 748d4444-fd70-4c43-8c6c-84509fbfa325

📥 Commits

Reviewing files that changed from the base of the PR and between a61b99d and d19f160.

📒 Files selected for processing (1)

• internal/tests/functional/testdata/testcases.txt

---

Walkthrough

Template filtering now restricts IncludeTags overrides to matching excluded tags. Explicit template inclusion remains an override, while other exclusions and normal inclusion criteria continue to apply. Tests cover matching tags and unrelated filter combinations.

Changes

Filter semantics

Layer / File(s)	Summary
Filter matching rules pkg/catalog/index/filter.go	Documents precedence rules, limits forced inclusion to IncludeTemplates, and allows IncludeTags to override only the same excluded tag.
Filter precedence tests pkg/catalog/index/filter_test.go, internal/tests/functional/testdata/testcases.txt	Verifies matching tag overrides and confirms that unrelated tags, exclusions, and normal inclusion criteria are not overridden; defers the affected functional case pending a future release.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Poem

I’m a rabbit with filters to tune,
Matching tags now hop in tune.
Other exclusions hold their ground,
Explicit templates still leapbound.
Tests check each path with care—
Clean results are everywhere!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change to include-tags filtering.
Linked Issues check	✅ Passed	The filter logic now keeps exclude-id and exclude-templates effective even when templates are selected via include-tags.
Out of Scope Changes check	✅ Passed	The test data change is supporting coverage for the same filtering behavior and is within scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dwisiswant0/fix/index/limit-include-tags-to-matching-tag-exclusions

---

_{Comment @coderabbitai help to get the list of available commands.}

[dwisiswant0]

Lint should be fixed by #7537

[dwisiswant0]

Lint should be fixed by #7537

The lint related is already in and it just needs to rebase from dev, @Mzack9999.