fix(sdk): apply the files section of .nuclei-ignore

lib/sdk_private.go

@@ -135,9 +135,14 @@ func (e *NucleiEngine) applyRequiredDefaults(ctx context.Context) {
 		e.opts.ExcludeTags = []string{}
 	}
 
-	// these templates are known to have weak matchers
-	// and idea is to disable them to avoid false positives
-	e.opts.ExcludeTags = append(e.opts.ExcludeTags, config.ReadIgnoreFile().Tags...)
+	// .nuclei-ignore blocks templates that should not run by default, by tag
+	// (dos, fuzz, ...) and by path (templates known to have weak matchers, which
+	// would otherwise generate false positives). Both sections are applied, as
+	// the CLI runner does — applying only the tags leaves the `files` section
+	// inert for every SDK consumer.
+	ignoreFile := config.ReadIgnoreFile()
+	e.opts.ExcludeTags = append(e.opts.ExcludeTags, ignoreFile.Tags...)
+	e.opts.ExcludedTemplates = append(e.opts.ExcludedTemplates, ignoreFile.Files...)
 
 	e.inputProvider = provider.NewSimpleInputProvider()
 }

lib/sdk_test.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	nuclei "github.com/projectdiscovery/nuclei/v3/lib"
+	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
 	"github.com/projectdiscovery/nuclei/v3/pkg/types"
 	"github.com/stretchr/testify/require"
 )
@@ -120,3 +121,35 @@ func TestWithOptionsRateLimitSetsRuntimeLimiter(t *testing.T) {
 	require.NotNil(t, execOpts.RateLimiter, "rate limiter should be initialized")
 	require.Equal(t, opts.RateLimit, int(execOpts.RateLimiter.GetLimit()), "runtime limiter should match rate limit from WithOptions")
 }
+
+// TestIgnoreFileFilesSectionIsApplied verifies the SDK applies BOTH sections of
+// .nuclei-ignore, matching the CLI runner. The files section suppresses
+// templates known to have weak matchers, so skipping it hands SDK consumers
+// false positives the CLI would never report.
+func TestIgnoreFileFilesSectionIsApplied(t *testing.T) {
+	previousConfigDir := config.DefaultConfig.GetConfigDir()
+	previousTemplatesDir := config.DefaultConfig.TemplatesDirectory
+	t.Cleanup(func() {
+		config.DefaultConfig.SetConfigDir(previousConfigDir)
+		config.DefaultConfig.SetTemplatesDir(previousTemplatesDir)
+	})
+
+	dir := t.TempDir()
+	config.DefaultConfig.SetConfigDir(dir)
+	config.DefaultConfig.SetTemplatesDir(dir)
+
+	ignoreFile := "tags:\n  - dos\nfiles:\n  - http/fuzzing/wordpress-themes-detect.yaml\n"
+	require.NoError(t, os.WriteFile(config.DefaultConfig.GetActiveIgnoreFilePath(), []byte(ignoreFile), 0o600))
+
+	ne, err := nuclei.NewNucleiEngineCtx(context.Background(),
+		nuclei.WithOptions(types.DefaultOptions()),
+		nuclei.DisableUpdateCheck(),
+	)
+	require.NoError(t, err, "could not create nuclei engine")
+	defer ne.Close()
+
+	require.Contains(t, ne.Options().ExcludeTags, "dos",
+		"tags section should reach ExcludeTags")
+	require.Contains(t, ne.Options().ExcludedTemplates, "http/fuzzing/wordpress-themes-detect.yaml",
+		"files section should reach ExcludedTemplates")
+}