fix(finding): key header findings by value and sort findings deterministically

multi-valued headers (set-cookie) emitted one finding per value but keyed
on name alone, so store.Diff collapsed every value but the first onto one
key. fold the value into the header key so distinct values stay distinct.

several flatten funcs source findings off randomized go map iteration (js
env vars, header names), leaving report output order non-deterministic
across identical scans. sort the flattened slice on the stable key once in
Flatten so json/sarif/markdown/-silent all render a stable order.

Author: TBX3D

internal/finding/finding.go

@@ -19,6 +19,7 @@ package finding
 
 import (
 	"fmt"
+	"sort"
 	"strings"
 
 	"github.com/projectdiscovery/nuclei/v3/pkg/output"
@@ -82,78 +83,79 @@ func key(module, identifier string) string {
 // keyed "module:unhandled" so a new scanner surfaces loudly instead of
 // vanishing - the guard test asserts this never happens for a known type.
 func Flatten(target, module string, result any) []Finding {
+	var out []Finding
 	switch r := result.(type) {
 	case *scan.ShodanResult:
-		return flattenShodan(target, r)
+		out = flattenShodan(target, r)
 	case *scan.SQLResult:
-		return flattenSQL(target, r)
+		out = flattenSQL(target, r)
 	case *scan.LFIResult:
-		return flattenLFI(target, r)
+		out = flattenLFI(target, r)
 	case *scan.JWTResult:
-		return flattenJWT(target, r)
+		out = flattenJWT(target, r)
 	case *scan.OpenAPIResult:
-		return flattenOpenAPI(target, r)
+		out = flattenOpenAPI(target, r)
 	case *scan.FaviconResult:
-		return flattenFavicon(target, r)
+		out = flattenFavicon(target, r)
 	case *scan.CMSResult:
-		return flattenCMS(target, r)
+		out = flattenCMS(target, r)
 	case *scan.SecurityTrailsResult:
-		return flattenSecurityTrails(target, r)
+		out = flattenSecurityTrails(target, r)
 	case *scan.CORSResult:
-		return flattenCORS(target, r)
+		out = flattenCORS(target, r)
 	case *scan.RedirectResult:
-		return flattenRedirect(target, r)
+		out = flattenRedirect(target, r)
 	case *scan.XSSResult:
-		return flattenXSS(target, r)
+		out = flattenXSS(target, r)
 	case *scan.CrawlResult:
-		return flattenCrawl(target, r)
+		out = flattenCrawl(target, r)
 	case *scan.PassiveResult:
-		return flattenPassive(target, r)
+		out = flattenPassive(target, r)
 	case *scan.ProbeResult:
-		return flattenProbe(target, r)
+		out = flattenProbe(target, r)
 	case scan.HeaderResults:
-		return flattenHeaders(target, r)
+		out = flattenHeaders(target, r)
 	case []scan.HeaderResult:
 		// the headers module appends a literal []HeaderResult, not the named
 		// slice type; both reach here so cover both.
-		return flattenHeaders(target, r)
+		out = flattenHeaders(target, r)
 	case scan.SecurityHeaderResults:
-		return flattenSecurityHeaders(target, r)
+		out = flattenSecurityHeaders(target, r)
 	case []scan.SecurityHeaderResult:
-		return flattenSecurityHeaders(target, r)
+		out = flattenSecurityHeaders(target, r)
 	case scan.DirectoryResults:
-		return flattenDirlist(target, r)
+		out = flattenDirlist(target, r)
 	case []scan.DirectoryResult:
-		return flattenDirlist(target, r)
+		out = flattenDirlist(target, r)
 	case scan.CloudStorageResults:
-		return flattenCloudStorage(target, r)
+		out = flattenCloudStorage(target, r)
 	case []scan.CloudStorageResult:
-		return flattenCloudStorage(target, r)
+		out = flattenCloudStorage(target, r)
 	case scan.DorkResults:
-		return flattenDork(target, r)
+		out = flattenDork(target, r)
 	case []scan.DorkResult:
-		return flattenDork(target, r)
+		out = flattenDork(target, r)
 	case scan.SubdomainTakeoverResults:
-		return flattenTakeover(target, r)
+		out = flattenTakeover(target, r)
 	case []scan.SubdomainTakeoverResult:
-		return flattenTakeover(target, r)
+		out = flattenTakeover(target, r)
 	case *frameworks.FrameworkResult:
-		return flattenFramework(target, r)
+		out = flattenFramework(target, r)
 	case *js.JavascriptScanResult:
-		return flattenJS(target, r)
+		out = flattenJS(target, r)
 	case *modules.Result:
 		// yaml/builtin modules carry their own module id; honor it over the
 		// passed-in module so per-module findings stay attributed correctly.
-		return flattenModule(target, r)
+		out = flattenModule(target, r)
 	case []output.ResultEvent:
-		return flattenNuclei(target, r)
+		out = flattenNuclei(target, r)
 	case []string:
 		// dnslist/portscan/git all hand back a bare []string of discovered
 		// items; module disambiguates which inventory it is.
-		return flattenStrings(target, module, r)
+		out = flattenStrings(target, module, r)
 	default:
 		// unknown type: emit a loud placeholder rather than dropping it.
-		return []Finding{{
+		out = []Finding{{
 			Target:   target,
 			Module:   module,
 			Severity: SeverityUnknown,
@@ -162,6 +164,13 @@ func Flatten(target, module string, result any) []Finding {
 			Raw:      fmt.Sprintf("%T", result),
 		}}
 	}
+	// some flatten* funcs source findings off Go map iteration (js env vars,
+	// header names upstream in the headers scanner), which is randomized per
+	// run. sort on the stable Key here, once, so every report surface (json,
+	// sarif, markdown, -silent) renders the same order across identical scans
+	// instead of churning on nothing but map-order luck.
+	sort.SliceStable(out, func(i, j int) bool { return out[i].Key < out[j].Key })
+	return out
 }
 
 func flattenShodan(target string, r *scan.ShodanResult) []Finding {
@@ -477,11 +486,14 @@ func flattenHeaders(target string, rs []scan.HeaderResult) []Finding {
 	out := make([]Finding, 0, len(rs))
 	for i := 0; i < len(rs); i++ {
 		h := rs[i]
+		// a multi-valued header (Set-Cookie is the canonical case) emits one
+		// HeaderResult per value; the value must ride in the identifier or
+		// every value but the first collapses onto one dedup Key.
 		out = append(out, Finding{
 			Target:   target,
 			Module:   "headers",
 			Severity: sevRecon,
-			Key:      key("headers", h.Name),
+			Key:      key("headers", h.Name+":"+h.Value),
 			Title:    h.Name,
 			Raw:      h.Value,
 		})
@@ -656,8 +668,7 @@ func flattenJS(target string, r *js.JavascriptScanResult) []Finding {
 			Raw:      e,
 		})
 	}
-	// env vars are a map; sort-free since the Key carries the name, and diff
-	// keys on the Key not on iteration order.
+	// map order is random here; Flatten sorts by Key (see comment above sort.SliceStable).
 	for name, value := range r.FoundEnvironmentVars {
 		out = append(out, Finding{
 			Target:   target,

internal/finding/finding_test.go

@@ -314,7 +314,7 @@ func TestFlattenStableKeysAndSeverities(t *testing.T) {
 			name:    "header is recon info",
 			value:   scan.HeaderResults{{Name: "Server", Value: "nginx"}},
 			module:  "headers",
-			wantKey: "headers:Server",
+			wantKey: "headers:Server:nginx",
 			wantSev: SeverityInfo,
 		},
 		{
@@ -381,3 +381,39 @@ func TestDeadProbeIsNotAFinding(t *testing.T) {
 		t.Errorf("dead probe produced %d findings, want 0", len(findings))
 	}
 }
+
+func TestMultiValuedHeaderGetsDistinctKeys(t *testing.T) {
+	hdrs := []scan.HeaderResult{
+		{Name: "Set-Cookie", Value: "session=aaa; HttpOnly"},
+		{Name: "Set-Cookie", Value: "tracking=bbb"},
+	}
+	fs := Flatten(target, "headers", hdrs)
+	if len(fs) != 2 {
+		t.Fatalf("flatten len = %d, want 2", len(fs))
+	}
+	if fs[0].Key == fs[1].Key {
+		t.Fatalf("distinct header values %q and %q share dedup Key %q", fs[0].Raw, fs[1].Raw, fs[0].Key)
+	}
+}
+
+func TestJSEnvVarOrderingIsStable(t *testing.T) {
+	res := &js.JavascriptScanResult{
+		FoundEnvironmentVars: map[string]string{
+			"A_KEY": "1", "B_KEY": "2", "C_KEY": "3",
+			"D_KEY": "4", "E_KEY": "5", "F_KEY": "6",
+		},
+	}
+
+	orderings := make(map[string]struct{})
+	for i := 0; i < 200; i++ {
+		fs := Flatten(target, "js", res)
+		keys := make([]string, 0, len(fs))
+		for _, f := range fs {
+			keys = append(keys, f.Key)
+		}
+		orderings[strings.Join(keys, ",")] = struct{}{}
+	}
+	if len(orderings) != 1 {
+		t.Errorf("Flatten produced %d distinct env-var orderings over 200 runs, want 1", len(orderings))
+	}
+}