Repository: projectdiscovery/nuclei

Issue:
Nil pointer panic in WAF detector during DetectWAF operation
## Problem Description

A nil pointer dereference panic was occurring in the WAF detector during the `DetectWAF` operation, causing segmentation violations.

## Stack Trace

```
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation]

goroutine 514296 [runnable]:
regexp.(*machine).match(0xc013a56780, {0x53b7060, 0xc013a56840}, {...})
    /opt/hostedtoolcache/go/1.24.1/x64/src/regexp/exec.go:340 +0x265
github.com/projectdiscovery/nuclei/v3/pkg/output/stats/waf.(*WafDetector).DetectWAF(0x100000000000000?, {0xc145c10000, 0x2036c})
    /home/runner/work/aurora/aurora/vendor/github.com/projectdiscovery/nuclei/v3/pkg/output/stats/waf/waf.go:57 +0xc8
```

## Resolution

This issue has been fixed in PR #6368 by adding proper nil checks for the detector, regexCache, and individual regex entries before invoking MatchString().

## References

- Fixed by: https://github.com/projectdiscovery/nuclei/pull/6368
- Reported by: @knakul853
- Original comment: https://github.com/projectdiscovery/nuclei/pull/6368#issuecomment-

Discussion:

Solution patch:
diff --git a/pkg/output/stats/waf/waf.go b/pkg/output/stats/waf/waf.go
index a660ff7b..7abe68ca 100644
--- a/pkg/output/stats/waf/waf.go
+++ b/pkg/output/stats/waf/waf.go
@@ -53,8 +53,12 @@ func NewWafDetector() *WafDetector {
 }
 
 func (d *WafDetector) DetectWAF(content string) (string, bool) {
+	if d == nil || d.regexCache == nil {
+		return "", false
+	}
+
 	for id, regex := range d.regexCache {
-		if regex.MatchString(content) {
+		if regex != nil && regex.MatchString(content) {
 			return id, true
 		}
 	}



Test patch:
diff --git a/pkg/output/stats/waf/waf_test.go b/pkg/output/stats/waf/waf_test.go
index 0698b3a4..f3b2b868 100644
--- a/pkg/output/stats/waf/waf_test.go
+++ b/pkg/output/stats/waf/waf_test.go
@@ -1,6 +1,9 @@
 package waf
 
-import "testing"
+import (
+	"regexp"
+	"testing"
+)
 
 func TestWAFDetection(t *testing.T) {
 	detector := NewWafDetector()
@@ -58,3 +61,61 @@ func TestWAFDetection(t *testing.T) {
 		})
 	}
 }
+
+func TestWAFDetectionNilPointerSafety(t *testing.T) {
+	tests := []struct {
+		name     string
+		detector *WafDetector
+		content  string
+	}{
+		{
+			name:     "nil detector",
+			detector: nil,
+			content:  "test content",
+		},
+		{
+			name: "nil regexCache",
+			detector: &WafDetector{
+				wafs:       make(map[string]waf),
+				regexCache: nil,
+			},
+			content: "test content",
+		},
+		{
+			name: "regexCache with nil regex",
+			detector: &WafDetector{
+				wafs: make(map[string]waf),
+				regexCache: map[string]*regexp.Regexp{
+					"test": nil,
+				},
+			},
+			content: "test content",
+		},
+		{
+			name: "empty regexCache",
+			detector: &WafDetector{
+				wafs:       make(map[string]waf),
+				regexCache: make(map[string]*regexp.Regexp),
+			},
+			content: "test content",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Errorf("DetectWAF panicked with nil pointer: %v", r)
+				}
+			}()
+
+			waf, matched := tt.detector.DetectWAF(tt.content)
+			if matched {
+				t.Errorf("expected no match for nil pointer case, got match=true, waf=%s", waf)
+			}
+			if waf != "" {
+				t.Errorf("expected empty WAF string for nil pointer case, got waf=%s", waf)
+			}
+		})
+	}
+}