fix: replace panic with error handling in template loader (#6674)

[umer12-12]

Proposed Changes
Fixed issue #6674 by replacing panic() calls with proper error handling in the template loading logic.

Key Fixes
Replaced panics in pkg/catalog/loader/loader.go and pkg/templates/parser.go.

Resolved "no new variables" error in internal/runner/lazy.go.

Updated function signatures to return error and handled them in the runner.

Proof
Verified compilation with go build -o nuclei.exe ./cmd/nuclei (Exit code 0).

nuclei.exe binary generated successfully.

/claim #6674

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[neo-by-projectdiscovery-dev]

Neo - PR Security Review

No security issues found

Highlights

• Adds ClusterMappings feature to track template cluster IDs and their constituent templates
• Fixes race condition in fuzz module by cloning maps before concurrent access
• Adds GitHub workflow for memoization automation
• Updates dependencies in go.mod and go.sum

Hardening Notes

• The PR description mentions panic-to-error-handling refactor, but the actual changes are primarily new features (ClusterMappings) and a race condition fix. Existing panic() calls remain in pkg/templates/compile.go:159 and pkg/templates/parser.go:80,89,98 - these are internal assertions not exploitable by attackers.
• The race condition fix in pkg/fuzz/execute.go:225 uses maps.Clone(data) to prevent concurrent map access. This addresses a crash bug, not an exploitable vulnerability.
• ClusterMappingsMap in pkg/templates/types/cluster_mappings.go implements nil-safe methods with proper defensive checks on lines 15-16, 24-25, 36-37.
• All panic() calls identified are internal assertions that cannot be triggered by attacker-controlled input and only cause application crashes, not exploitation vectors.

_{Comment @neo help for available commands. · Open in Neo}