fix(installer): validate nuclei ignore file downloads

[lucasonline0]

Summary

Fixes #7651.

Prevent invalid responses from the nuclei-ignore update endpoint from replacing the local .nuclei-ignore file.

UpdateIgnoreFile previously wrote the response body directly to disk. Corporate filtering proxies can return an HTML block page instead of the ignore file, including with a successful HTTP response, leaving .nuclei-ignore corrupted and causing parse errors on subsequent runs.

Changes

• reject non-2xx responses from the nuclei-ignore endpoint
• validate downloaded YAML and require the expected tags or files shape before writing it
• preserve the existing .nuclei-ignore when validation fails
• close the update response body
• add regression coverage for a proxy HTML response and unrelated YAML

Validation

• golangci-lint
• make vet
• make build
• make test
• functional and scale regression checks

Validation passed on Linux, Windows, and macOS.

Summary by CodeRabbit

• Bug Fixes

  • Ignore-file updates now reject invalid, malformed, oversized, empty, multi-document, or unexpected content.
  • Existing valid ignore files remain unchanged when an update is rejected.
  • Valid updates preserve supported tag and file configurations.
  • Unexpected download responses no longer create invalid ignore files.

• Tests

  • Added coverage for valid updates, rejected responses, malformed content, and file preservation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 28b9c65b-d6ef-4e71-878a-f9a191235856

📥 Commits

Reviewing files that changed from the base of the PR and between 4fb9d22 and dd23746.

📒 Files selected for processing (1)

• pkg/installer/versioncheck_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• pkg/installer/versioncheck_test.go

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

Walkthrough

The installer now validates downloaded .nuclei-ignore YAML before writing it. It rejects invalid content and non-2xx responses, preserves the existing file on errors, closes response bodies, and updates the hash only after a successful write.

Changes

Ignore file validation

Layer / File(s)	Summary
Validate and write ignore content pkg/installer/versioncheck.go, pkg/installer/versioncheck_test.go	writeNucleiIgnoreFile validates YAML, requires tags or files, decodes config.IgnoreFile, and preserves valid existing content when validation fails.
Integrate validation into updates pkg/installer/versioncheck.go	UpdateIgnoreFile closes the response body, rejects non-2xx responses, and updates the hash after a successful validated write.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to dd237

Ignore-file downloads now reject invalid responses while preserving the existing configuration, preventing corrupted updates from causing later parsing failures. No merge-blocking risk is currently identified.

Poem

I’m a rabbit with a careful ear,
I guard clean YAML far and near.
Bad proxy bytes must stay outside,
Valid tags and files may safely glide.
The ignore file now hops with pride! 🐇

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 5.56% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: validating Nuclei ignore-file downloads.
Linked Issues check	✅ Passed	The changes address issue #7651 by validating ignore-file YAML and HTTP responses, preserving the existing file when validation fails, and adding regression tests for corrupted proxy responses and inv…
Out of Scope Changes check	✅ Passed	The implementation and tests remain within scope. They support safe ignore-file downloads, validation, atomic update behavior, and regression coverage for issue #7651.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[neo-by-projectdiscovery-dev]

Neo - PR Security Review

No exploitable vulnerabilities in this commit — the only change is a one-line test assertion fix with no production code touched.

Hardening Notes

• The delta since 4fb9d22 modifies only pkg/installer/versioncheck_test.go: the assertion require.Contains(t, err.Error(), path) is updated to require.Contains(t, err.Error(), fmt.Sprintf("%q", path)) to match the quoted path format in the error returned by WriteActiveIgnoreFile.
• All three scanner passes (TruffleHog, Semgrep, ast-grep) returned zero findings on the delta.
• The security-relevant production logic reviewed in the prior pass (UpdateIgnoreFile HTTP status gating, YAML shape validation, atomic write, 1 MB cap) is unchanged.

What Neo reviewed

pkg/installer/versioncheck_test.go

_{Comment @pdneo help for available commands. · Open in Neo}