passive exports

[Mzack9999]

Summary

• Attach response bodies from burp/jsonl/yaml exports and match them in passive/offline HTTP mode
• Skip OfflineHTTP filepath transforms (and DAST forcing) when inputs already carry responses

Closes #5414

Summary by CodeRabbit

• New Features
  • Added support for optional HTTP response bodies in JSON, YAML, and Burp Suite inputs; parsed responses are now available for downstream processing.
• Bug Fixes
  • Preserved HTTP payload formatting during Burp Suite parsing.
  • Offline HTTP now prefers embedded in-memory response bodies for matching/evaluation, skipping transformation and avoiding accidental file-path handling when no response body is present.
  • Prevented automatic DAST auto-enablement when Offline HTTP is active.
• Tests
  • Expanded parsing and offline execution test coverage for response content.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cc5e6186-5505-4387-b554-45b688b029f1

📥 Commits

Reviewing files that changed from the base of the PR and between c2ac1d8 and 0ff225c.

📒 Files selected for processing (2)

• pkg/protocols/offlinehttp/request.go
• pkg/protocols/offlinehttp/request_export_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• pkg/protocols/offlinehttp/request.go
• pkg/protocols/offlinehttp/request_export_test.go

---

Walkthrough

The PR adds response extraction for Burp, JSON, and YAML inputs, routes embedded responses through offline HTTP execution, skips transformations for those responses, and prevents offline mode from automatically enabling DAST.

Changes

Offline passive scanning

Layer / File(s)	Summary
Parse exported request and response data pkg/input/formats/burp/*, pkg/input/formats/json/*, pkg/input/formats/yaml/*	Parsers now preserve exported response headers and bodies, with tests validating response content.
Execute embedded offline responses pkg/protocols/offlinehttp/*	Offline HTTP execution consumes embedded response data and skips inputs that contain no response body.
Skip offline transformations pkg/tmplexec/*	Execution paths detect offline responses and avoid applying input transformations.
Preserve passive offline mode internal/runner/runner.go, internal/server/nuclei_sdk.go	DAST auto-enablement is disabled for offline HTTP execution.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ExportedFormat
  participant OfflineHTTP
  participant TemplateExecutor
  participant Matcher
  ExportedFormat->>OfflineHTTP: provide request URL and response raw data
  OfflineHTTP->>TemplateExecutor: execute embedded response
  TemplateExecutor->>Matcher: evaluate response without input transformation
  Matcher-->>TemplateExecutor: return operator result

Loading

Suggested reviewers: dogancanbakir, ice3man543

Poem

I’m a rabbit with packets tucked tight,
Parsing responses by moonlit byte-light.
Burp, JSON, YAML hop through the queue,
Offline scans keep their headers true.
No active DAST leap, just a passive delight!

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 18.18% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title is too vague to describe the main change in the PR.	Rename it to a concise summary of passive/offline export scanning support, e.g. "Support passive exports for imported responses".

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	The PR adds passive-mode support for imported responses and bypasses offline HTTP transforms, matching issue #5414.
Out of Scope Changes check	✅ Passed	The changes stay focused on passive/offline HTTP export support and related parsing, execution, and tests.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 5414-passive-exports

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/protocols/offlinehttp/request.go`:
- Around line 41-54: Update the embedded-response branch in the request
execution flow around ReqResp.Response and executeRawInput so successful scans
increment the same progress/stat counter as the normal path before returning.
Reuse the existing IncrementRequests() mechanism and preserve the current
early-return behavior for the scan result.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9da4c61f-2f07-4184-8c28-5bdd7212e14c

📥 Commits

Reviewing files that changed from the base of the PR and between bcf2089 and c2ac1d8.

📒 Files selected for processing (15)

• internal/runner/runner.go
• internal/server/nuclei_sdk.go
• pkg/input/formats/burp/burp.go
• pkg/input/formats/burp/burp_test.go
• pkg/input/formats/json/json.go
• pkg/input/formats/json/json_test.go
• pkg/input/formats/yaml/multidoc.go
• pkg/input/formats/yaml/multidoc_test.go
• pkg/protocols/offlinehttp/request.go
• pkg/protocols/offlinehttp/request_export_test.go
• pkg/tmplexec/flow/flow_internal.go
• pkg/tmplexec/generic/exec.go
• pkg/tmplexec/multiproto/multi.go
• pkg/tmplexec/utils/utils.go
• pkg/tmplexec/utils/utils_test.go