feat(input): add per-target JSONL filters

[3nesdeniz]

Proposed changes

Closes #4934.

This adds a target-oriented JSONL mode in which each URL can override tags, exclude-tags, severity, and local templates while omitted fields inherit the corresponding global options:

{"url":"https://target-a.example","tags":["apache","shiro"],"severity":["critical","high"]}
{"url":"https://target-b.example","exclude-tags":["tomcat"],"templates":["http/cves/2026/"]}
{"url":"https://target-c.example"}

nuclei -l targets.jsonl -input-mode jsonl

The implementation:

• extends the existing JSONL parser without changing legacy Proxify request/response behavior;
• preserves omitted versus explicitly empty fields so inheritance is deterministic;
• resolves each unique template selector plan once and loads a safe template superset;
• filters target/template pairs before execution in both template-spray and host-spray strategies;
• preserves clustered physical requests while selecting only the permitted operators for each target;
• applies -exclude-hosts before caching target records;
• keeps legacy MetaInput IDs, hashes, preflight keys, and multiformat behavior unchanged when no target overrides are present.

For combinations whose child execution cannot yet preserve independent target criteria, the runner returns a clear error instead of silently bypassing filters. This currently covers automatic scan, workflows, and global matchers. Per-target template selectors are local-only and cannot be combined with global remote template URLs.

An explicitly empty field clears the inherited CLI selection. For templates, this is equivalent to clearing -t and therefore falls back to the default template catalog.

This is a draft so maintainers can confirm those boundary semantics before it is marked ready.

Proof

• go test -race ./internal/runner ./pkg/input/provider/http ./pkg/input/formats/json ./pkg/protocols/common/contextargs ./pkg/core ./pkg/templates
• go test -tags=integration ./internal/tests/integration -run '^TestTargetJSONLTemplateFilters$' -count=1 -v
  • template-spray and host-spray
  • clustered templates
  • target exclusions
  • per-target template selection
• go vet -tags=integration ./internal/tests/integration
• make vet
• make build
• git diff --check

The complete local make test run reached four packages whose Interactsh tests could not register with the public OAST service. The same focused failures reproduce on an untouched upstream/dev worktree at bcf20899; all target-filter packages and integration scenarios above pass with the race detector where applicable.

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b51b980a-490f-4e41-b0e1-5474dd80a747

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}