feat(fuzz): add XSS context analyzer for reflection-based detection

[teredasites]

Summary

Resolves #5838

Adds a new xss_context analyzer to the nuclei fuzzing engine that performs context-aware reflected XSS detection. Unlike simple regex-based checks, this analyzer parses the HTML response with Go's tokenizer to determine where user input is reflected and selects payloads that can structurally achieve script execution in that specific context.

How it works

Phase 1 - Canary injection: The [XSS_CANARY] placeholder in the fuzzing payload is replaced with a marker containing special characters (<>"'/). After the server processes the request, we check which characters survived encoding/filtering.

Phase 2 - Context detection: The HTML tokenizer walks the response and classifies each reflection into one of 8 contexts:

• html_text - between tags (needs <script> or event handler injection)
• attribute / attribute_unquoted - inside attribute values (needs quote breakout)
• script / script_string - inside <script> blocks or JS string literals
• html_comment - inside <!-- --> (needs --> breakout)
• style - inside <style> blocks (needs </style> breakout)

Phase 3 - Payload replay & verification: For each reflection point, payloads are filtered by character requirements (no point sending <script> if < is encoded). Surviving payloads are replayed through the original fuzz component and the response is checked for unencoded executable content.

Key design decisions

• Zero-allocation event handler detection: Uses stack-allocated byte buffers with bitwise case folding for the hot-path isEventHandler() check across 80+ event handlers
• Windowed character survival detection: Only checks characters within the token containing the marker, avoiding false positives from unrelated page content
• Proper tag stack management: Name-matched popping handles nested/misnested elements correctly
• Component state save/restore: The replay path saves the original fuzz component value and restores it after each payload attempt
• Drain fallback: drainRemainingReflections() catches markers in malformed/truncated HTML that the tokenizer missed

Template usage

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    fuzzing:
      - part: query
        type: replace
        mode: single
        fuzz:
          - "[XSS_CANARY]"
    analyzer:
      name: xss_context
      parameters:
        canary: "optional_custom_canary"  # optional

Files changed

File	Change
pkg/fuzz/analyzers/xss/types.go	Context types, CharacterSet, ReflectionInfo, 80+ event handlers map
pkg/fuzz/analyzers/xss/context_detector.go	HTML tokenizer-based reflection detection engine
pkg/fuzz/analyzers/xss/payload_selector.go	Context-aware payload selection with character filtering
pkg/fuzz/analyzers/xss/analyzer.go	Main analyzer: registration, canary injection, replay & verify
pkg/fuzz/analyzers/analyzers.go	Added ResponseBody/Headers/StatusCode to Options struct
pkg/protocols/http/http.go	Blank import for xss analyzer registration
pkg/protocols/http/request.go	Pass response data to analyzer Options
pkg/templates/templates_doc.go	Added xss_context to valid values
SYNTAX-REFERENCE.md	Documentation update
pkg/testutils/fuzzplayground/server.go	6 XSS test endpoints for each context

Test coverage

47 tests covering:

• Context detection for all 8 context types including edge cases (RCDATA elements, attribute key injection, script string escape handling)
• Event handler detection (12 subtests including case variants and non-handlers)
• Payload selection and filtering across all contexts
• Character survival detection
• Canary replacement with custom and default values
• Replay body verification for each context type

$ go test -v ./pkg/fuzz/analyzers/xss/...
PASS
ok  github.com/projectdiscovery/nuclei/v3/pkg/fuzz/analyzers/xss  0.442s

/claim

[neo-by-projectdiscovery-dev]

Neo - PR Security Review

No security issues found

Highlights

• Adds XSS context analyzer that detects reflected XSS vulnerabilities in target applications using HTML tokenization and context-aware payload selection
• Introduces honeypot detection to identify hosts that match many templates (likely honeypots on scanning platforms)
• Uses Go's standard html.Tokenizer from golang.org/x/net/html for safe parsing of potentially malformed HTML responses
• Implements defensive limits (maxReflections=16) to prevent memory exhaustion from malicious responses

Hardening Notes

• Consider adding a timeout or size limit for HTML tokenization in context_detector.go:47 to prevent DoS from extremely large response bodies
• The markerCharSurvived function in types.go:249 has a logic issue - it checks if the marker is present rather than if the specific character survived (line 255 returns strings.Contains(body, marker) instead of checking the char). While not exploitable, this could cause false positives in XSS detection
• Consider validating the custom canary parameter length in analyzer.go:64 to prevent excessively large canaries that could impact performance

_{Comment @neo help for available commands. · Open in Neo}