Proposed Changes

Replaces two panic() calls in LoadTemplatesWithTags (pkg/catalog/loader/loader.go, lines ~714 and ~722) with proper error returns using fmt.Errorf, allowing callers to handle failures gracefully instead of crashing.

/claim #6674

What changed

File Change
pkg/catalog/loader/loader.go LoadTemplatesWithTags returns ([]*templates.Template, error); LoadTemplates returns ([]*templates.Template, error); Load() returns error; both panic() calls replaced with return nil, fmt.Errorf(...)
internal/runner/runner.go Load() error check added
internal/runner/lazy.go LoadTemplates error handling added
internal/server/nuclei_sdk.go Load() error check added
lib/sdk.go Load() error check added
lib/multi.go Load() error check added
cmd/integration-test/library.go Load() error check added
pkg/protocols/common/automaticscan/util.go LoadTemplatesWithTags error handling added
pkg/catalog/loader/loader_bench_test.go Updated to handle (_, error) return

Why these changes

The current code panics when:

  1. syncutil.New() fails to create a wait group
  2. protocolstate.GetDialersWithId() returns nil (dialers not initialized)

This is too harsh for a public API that may be exercised in non-scanning flows. The broader codebase pattern returns fmt.Errorf when encountering missing resources rather than panicking.

Proof

  • No behavioral change for success paths; only error paths are improved
  • Callers that previously would crash now receive descriptive errors
  • Error messages include context (execution ID, original error) for debugging
  • All changes follow existing codebase conventions (errors.Wrap, errkit.Wrapf, fmt.Errorf)

Checklist

  • PR created against the dev branch
  • All changes are minimal and focused on the issue
  • Callers updated to handle errors appropriately
  • Documentation: error conditions are self-documenting via fmt.Errorf messages

Fixes #6674

🤖 Built with AI assistance (Claude) Co-Authored-By: Claude noreply@anthropic.com

Summary by CodeRabbit

  • Bug Fixes

    • Template loading now surfaces and wraps load errors instead of ignoring them, preventing silent failures.
    • Loading aborts early on failures and logs warnings where appropriate instead of continuing with invalid state.
    • Detects and errors when multiple templates are found for a single path to avoid ambiguous results.
  • Refactor

    • Replaced panic/ignore patterns with explicit error returns and propagation across the template loading pipeline.
  • Tests

    • Benchmarks updated to check and fail on template load errors.

Claim

Total prize pool $200
Total paid $0
Status Pending
Submitted February 16, 2026
Last updated February 16, 2026

Contributors

ST

St34lthcole

@St34lthcole

100%

Sponsors

PR

ProjectDiscovery

@projectdiscovery

$100
MA

Madhavan Deepak

@Madhavan-Deepak

$100