feat (http) : expose TLS key exchange metadata

[chauhand2463]

Proposed changes

Closes #7665

Expose the negotiated TLS key exchange group in HTTP DSL metadata as key_exchange.

The value is populated from tls.ConnectionState.CurveID using CurveID.String().

When no key exchange group is available (CurveID == 0), key_exchange is omitted.

No TLS configuration, request handling, or handshake behavior is changed.

Proof

Tested with:

go test ./pkg/protocols/http -count=1

Result:

ok github.com/projectdiscovery/nuclei/v3/pkg/protocols/http

Also verified:

git diff --check

The tests cover:

• X25519
• X25519MLKEM768 hybrid key exchange
• missing/zero key exchange
• DSL response mapping

SYNTAX-REFERENCE.md was regenerated and includes key_exchange.

Checklist

• Pull request is created against the dev branch
• Tests passed with my changes
• Added tests for the feature
• Added necessary documentation

Summary by CodeRabbit

• New Features
  • HTTP request data now includes the negotiated TLS key exchange group, such as X25519 or X25519MLKEM768, when available.
• Documentation
  • Updated the syntax reference to document the new key_exchange request field.
• Bug Fixes
  • Key exchange information is omitted when no negotiated value is available.

[neo-by-projectdiscovery-dev]

Neo - PR Security Review

No exploitable security vulnerabilities — this change reads a uint16 from an already-established TLS connection and stores its constrained string form in the DSL event map, introducing no new attack surface.

What Neo reviewed

pkg/protocols/http/tls_metadata.go, pkg/protocols/http/http.go, pkg/protocols/http/tls_metadata_test.go

_{Comment @pdneo help for available commands. · Open in Neo}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 070a5833-3bb1-44bb-b516-105b89af19f9

📥 Commits

Reviewing files that changed from the base of the PR and between da279d4 and a1c26f9.

📒 Files selected for processing (4)

• SYNTAX-REFERENCE.md
• pkg/protocols/http/http.go
• pkg/protocols/http/tls_metadata.go
• pkg/protocols/http/tls_metadata_test.go

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

Walkthrough

The HTTP protocol now exposes the negotiated TLS key exchange group as key_exchange metadata. The change updates the request part definition, TLS event enrichment, syntax reference, and tests for classical, hybrid, and absent curve values.

Changes

HTTP TLS metadata

Layer / File(s)	Summary
Expose negotiated key exchange metadata pkg/protocols/http/http.go, pkg/protocols/http/tls_metadata.go, pkg/protocols/http/tls_metadata_test.go, SYNTAX-REFERENCE.md	The HTTP protocol records state.CurveID.String() as key_exchange when CurveID is non-zero. Tests cover X25519, X25519MLKEM768, and an absent field for zero CurveID. The request part and syntax reference document the new field.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to a1c26

This localized change exposes negotiated TLS key-exchange metadata without changing TLS configuration or request handling. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: mzack9999, dwisiswant0

Poem

A rabbit inspects the TLS trail,
Where key exchanges leave a tale.
X25519 hops in view,
Hybrid paths appear there too.
Empty curves stay out of sight,
Metadata now records them right.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 3 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: exposing TLS key exchange metadata for HTTP.
Linked Issues check	✅ Passed	The PR implements issue #7665 by exposing the negotiated TLS key exchange through key_exchange, preserving CurveID.String(), omitting the field for zero values, updating documentation, and adding …
Out of Scope Changes check	✅ Passed	All changes are limited to HTTP TLS metadata, related tests, and syntax documentation. No unrelated behavior or TLS configuration changes are present.

Full details: Linked Issues check

Explanation

The PR implements issue #7665 by exposing the negotiated TLS key exchange through key_exchange, preserving CurveID.String(), omitting the field for zero values, updating documentation, and adding coverage for classical, hybrid, missing, and DSL propagation cases.

Full details: Docstring Coverage

Explanation

Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 3 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}