[dogancanbakir]

Hoists the unsigned code-template guard ahead of the dast branch so it applies on every load path.

Fixes #7470

Summary by CodeRabbit

• New Features

  • Unsigned Code protocol templates are now prevented from being loaded and executed regardless of execution mode.

• Tests

  • Added test coverage for unsigned template handling scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d4259915-4ba4-4ad0-bd2f-115d10ff903f

📥 Commits

Reviewing files that changed from the base of the PR and between c041bf2 and 86bc90b.

⛔ Files ignored due to path filters (1)

• internal/tests/integration/testdata/protocols/code/dast-unsigned.yaml is excluded by !**/*.yaml

📒 Files selected for processing (2)

• internal/tests/integration/code_test.go
• pkg/catalog/loader/loader.go

---

Walkthrough

An early unconditional guard is added in LoadTemplatesWithTags to reject unsigned/unverified Code-protocol templates before the DAST loading branch, closing the bypass. The previously later-stage conditional performing the same check is removed. An integration test case is added to verify that unsigned templates are rejected when nuclei runs with -dast.

Changes

Unsigned Code Template DAST Gate

Layer / File(s)	Summary
Early unsigned Code template guard in loader pkg/catalog/loader/loader.go	Adds an early filter at line ~900 that detects unverified Code-protocol templates (non-workflow), increments tampered and unsigned skip counters, optionally logs a warning, and returns without loading. Removes the now-redundant later conditional at line ~941 that previously handled the same case but only after the DAST branch.
Integration test: unsigned Code rejected under -dast internal/tests/integration/code_test.go	Adds protocols/code/dast-unsigned.yaml to the codeTestCases table with isCodeDisabled gating, skips it in ensureSignedCodeTemplates, and implements dastUnsignedCode.Execute to run nuclei with -dast, treating execution error as the expected pass and failing if the unsigned template executes without error.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

• Mzack9999

Poem

🐇 A sneaky template tried to slip right through,
With a -dast disguise, unsigned and new.
But the loader's guard now checks the gate,
Unsigned code must wait — that's just its fate!
The rabbit stamps the diff: "Patch approved, hooray!" 🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and specifically describes the main change: enforcing code template signature checks before DAST loading, which is the core security fix.
Linked Issues check	✅ Passed	The PR directly addresses issue #7470 by moving the unsigned code-template validation guard to an earlier execution point, ensuring signature validation applies to all template load paths including DAST.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to the security issue: adding a test case for unsigned DAST templates, updating signing list generation to exclude it, and moving the validation guard earlier in the loader.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dast-code-load

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}