Can not use {{BaseURL}} in contains() function when use dsl matcher

[lnlinh31]

Is there an existing issue for this?

• I have searched the existing issues.

Current Behavior

When I use
dsl: - "status_code == 302 && !contains(header, 'Location: {{BaseURL}}/login/google')"
Nuclei will can not replace conresponding baseURL to the function (for example is https://example.com). This lead to my condition does not work as expect

Expected Behavior

Nuclei can replace conresponding baseURL to the function

Steps To Reproduce

When I use
dsl: - "status_code == 302 && !contains(header, 'Location: {{BaseURL}}/login/google')"
Nuclei will can not replace conresponding baseURL to the function (for example is https://example.com). This lead to my condition does not work as expect

Relevant log output

No response

Environment

- OS: ubuntu 20.04
- Nuclei: v3.3.2
- Go: go1.20.7 linux/amd64

Anything else?

No response

[dwisiswant0]

You don’t actually need to use {{ and }} for variable substitution when writing within the DSL. The {{}} format is mainly used in template request definitions, but in DSL expressions, the vars are directly accessible.

Here’s a simple workaround:

Instead of writing it like how you originally did, you can try: status_code == 302 && !contains(header, 'Location: ' + BaseURL + '/login/google')

This format should properly substitute the BaseURL var and make your condition function correctly.

Alternatively, you could also leverage the concat helper func, which allows you to concatenate literal strings & variables. Example: !contains(header, concat('Location: ', BaseURL, '/login/google'))

This should solve your issue and make the condition work as expected! Let me know how it goes

[lnlinh31]

That works. Thanks you @dwisiswant0