fix(gogo): populate pkg.ChainExec when injecting neutron templates#31
Merged
wuchulonly merged 2 commits intoJul 7, 2026
Merged
Conversation
engine.NeutronScan drives the package-global pkg.ChainExec, which is only
ever assigned by pkg.LoadTemplates. applyInjectedNeutron injects templates
by setting pkg.TemplateMap directly and bypasses LoadTemplates, so
pkg.ChainExec stays nil. Any exploit scan (RunnerOption.Exploit != "none")
then calls ChainExec.Execute on a nil receiver, panicking inside
engine.NeutronScan -> executeTemplates. The panic is caught only by the
ants scan pool ("worker exits from panic"), which silently drops that
host's result.
Build the ChainExecutor alongside TemplateMap (same registration gogo's
own pkg.LoadTemplates performs) so the injected-template path keeps the
two package globals consistent.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Both fail on master independently of the ChainExec fix; bundled here so
this PR's CI can go green (requested by maintainer).
- neutron/config_templates_test.go: OperatorResult (= parsers.NeutronResult)
now embeds parsers.Result, so Matched is a promoted field that cannot be
set in a composite literal. Assign it after construction.
(Was: "unknown field Matched in struct literal" -> neutron [build failed].)
- proton/engine_test.go TestEngine_ConfigFilter_IDs: the file extractor
filters out dummy values like "test", so `password = test` yielded 0
findings. Use a realistic value ("test123", as the sibling Execute test
already does); keep "PRIVATE KEY" in the input to assert the excluded
private-key-detect rule does not fire.
Not touched: examples/cases/spray_crawl_finger.TestSprayCrawlAndDeepFinger
fast-failed (~0.9s, not a timeout) once in CI but passes 15/15 locally and
shows no data race; it is flaky under parallel-package load, not stale.
Left as-is rather than hack an assertion I cannot reproduce failing.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Closed
wuchulonly
pushed a commit
to chainreactors/aiscan
that referenced
this pull request
Jul 7, 2026
Drop the local replace bridge and pin github.com/chainreactors/sdk to v0.3.4-0.20260707120839-686d4bfa2b2b (chainreactors/sdk#31, merged), which populates gogo's pkg.ChainExec when the SDK injects neutron templates. This fixes the ants "worker exits from panic" nil-pointer that aborted exploit scanning on every open host. TestGogoEngineInjectsChainExecutor now passes against the real pinned SDK (no replace). Refs #51 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Symptom
Any gogo scan with exploit enabled (
RunnerOption.Exploit != "none") panics per open host:The receiver is
0x0:engine.NeutronScandrives the package-globalpkg.ChainExec, which is only ever assigned bypkg.LoadTemplates.Root cause
applyInjectedNeutroninjects templates by settingpkg.TemplateMapdirectly and never goes throughpkg.LoadTemplates, sopkg.ChainExecis leftnil.executeTemplatesfinds a populatedTemplateMap(non-emptystartIDs) and then callsChainExec.Execute(...)on the nil global → panic atchain.go:80(e.config.DepthFirst). The ants pool swallows it, so the process survives but the host's result is silently dropped and the log is spammed.Fix
Build the
ChainExecutoralongsideTemplateMapinapplyInjectedNeutron, doing the sameid → chainsregistrationpkg.LoadTemplatesalready performs. This keeps the two gogo package globals consistent on the injected-template path. No signature or dependency changes (neutron/templatesis already a transitive dep;types.Templateis an alias oftemplates.Template).Test
gogo/gogo_chainexec_test.gocovers the new helper: id/chain registration, entrypoint resolution, and a chain walk (the exact call that hit the nil receiver).Verified downstream in aiscan — constructing the gogo engine with an injected neutron engine now leaves
pkg.ChainExec != nil; reverting this patch makes that assertion fail.🤖 Generated with Claude Code