fix: default optional template text inputs

zebbern · zebbern · commit 5e71828fd3a0 · 2026-06-22T03:28:28.000+02:00
Signed-off-by: zebbern &lt;185730623+zebbern@users.noreply.github.com&gt;
diff --git a/backend/scripts/seed-templates/api-surface-exposure-triage.json b/backend/scripts/seed-templates/api-surface-exposure-triage.json
@@ -53,13 +53,15 @@
                   "label": "Scan intensity",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "safe",
                   "description": "Use safe or thorough. Safe keeps candidate generation tightly bounded."
                 },
                 {
                   "id": "authorizationNotes",
                   "label": "Authorization notes",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Program scope, exclusions, and rate-limit notes to copy into the report."
                 }
               ]
diff --git a/backend/scripts/seed-templates/bug-bounty-recon-triage.json b/backend/scripts/seed-templates/bug-bounty-recon-triage.json
@@ -43,6 +43,7 @@
                   "label": "Authorization notes",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Program scope, exclusions, and rate-limit notes."
                 }
               ]
diff --git a/backend/scripts/seed-templates/cve-impact-research-brief.json b/backend/scripts/seed-templates/cve-impact-research-brief.json
@@ -46,20 +46,23 @@
                   "label": "Product",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Optional product name or technology under review."
                 },
                 {
                   "id": "version",
                   "label": "Version",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Optional deployed or suspected affected version."
                 },
                 {
                   "id": "deploymentNotes",
                   "label": "Deployment notes",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Internal context for authorized impact analysis."
                 }
               ]
diff --git a/backend/scripts/seed-templates/exposed-service-cve-mapper.json b/backend/scripts/seed-templates/exposed-service-cve-mapper.json
@@ -46,6 +46,7 @@
                   "label": "Authorization notes",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Scope notes and rate limits for the engagement."
                 }
               ]
diff --git a/backend/scripts/seed-templates/github-repo-dependency-cve-triage.json b/backend/scripts/seed-templates/github-repo-dependency-cve-triage.json
@@ -80,6 +80,7 @@
                   "label": "Branch, tag, or commit",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Git ref to read manifests from. Uses the repository default branch when omitted."
                 },
                 {
@@ -101,6 +102,7 @@
                   "label": "Research notes",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Program scope, repository context, or triage notes to include in the report."
                 }
               ]
diff --git a/backend/scripts/seed-templates/npm-dependency-cve-hunt.json b/backend/scripts/seed-templates/npm-dependency-cve-hunt.json
@@ -43,6 +43,7 @@
                   "label": "Research notes",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Optional program, repository, or triage context to include in the report."
                 }
               ]
diff --git a/backend/scripts/seed-templates/passive-osint-subdomain-expansion.json b/backend/scripts/seed-templates/passive-osint-subdomain-expansion.json
@@ -57,13 +57,15 @@
                   "label": "Scan intensity",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "safe",
                   "description": "Use safe, normal, or thorough. Safe keeps passive expansion and DNS queries tightly bounded."
                 },
                 {
                   "id": "authorizationNotes",
                   "label": "Authorization notes",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Program scope, exclusions, rate limits, and validation notes to include in the report."
                 }
               ]
diff --git a/backend/scripts/seed-templates/public-repo-code-iac-risk-triage.json b/backend/scripts/seed-templates/public-repo-code-iac-risk-triage.json
@@ -46,13 +46,15 @@
                   "label": "Branch, tag, or commit",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Git ref to inspect. Uses the repository default branch when omitted."
                 },
                 {
                   "id": "authorizationNotes",
                   "label": "Authorization notes",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Program scope, exclusions, and rate-limit notes to include in the report."
                 }
               ]
diff --git a/backend/scripts/seed-templates/public-repo-secret-exposure-triage.json b/backend/scripts/seed-templates/public-repo-secret-exposure-triage.json
@@ -3,13 +3,7 @@
     "name": "Public Repo Secret Exposure Triage",
     "description": "Authorized bug bounty workflow that scans a public Git repository for verified exposed secrets, redacts evidence, and writes a submission-ready triage report.",
     "category": "bug-bounty",
-    "tags": [
-      "bug-bounty",
-      "secrets",
-      "trufflehog",
-      "git",
-      "repository"
-    ],
+    "tags": ["bug-bounty", "secrets", "trufflehog", "git", "repository"],
     "author": "sentris-team",
     "version": "1.0.0"
   },
@@ -19,13 +13,7 @@
     "version": "1.0.0",
     "author": "sentris-team",
     "category": "bug-bounty",
-    "tags": [
-      "bug-bounty",
-      "secrets",
-      "trufflehog",
-      "git",
-      "repository"
-    ],
+    "tags": ["bug-bounty", "secrets", "trufflehog", "git", "repository"],
     "entryPoint": "trigger_1",
     "nodeCount": 4,
     "edgeCount": 8
@@ -58,6 +46,7 @@
                   "label": "Authorization notes",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Program scope, exclusions, and any reporting constraints for this repository."
                 }
               ]
diff --git a/backend/scripts/seed-templates/subdomain-takeover-triage.json b/backend/scripts/seed-templates/subdomain-takeover-triage.json
@@ -3,14 +3,7 @@
     "name": "Subdomain Takeover Triage",
     "description": "Authorized bug bounty workflow that discovers subdomains, checks DNS and HTTP takeover indicators, runs safe takeover templates, and writes a prioritized candidate report.",
     "category": "bug-bounty",
-    "tags": [
-      "bug-bounty",
-      "takeover",
-      "subdomains",
-      "dns",
-      "httpx",
-      "nuclei"
-    ],
+    "tags": ["bug-bounty", "takeover", "subdomains", "dns", "httpx", "nuclei"],
     "author": "sentris-team",
     "version": "1.0.0"
   },
@@ -20,14 +13,7 @@
     "version": "1.0.0",
     "author": "sentris-team",
     "category": "bug-bounty",
-    "tags": [
-      "bug-bounty",
-      "takeover",
-      "subdomains",
-      "dns",
-      "httpx",
-      "nuclei"
-    ],
+    "tags": ["bug-bounty", "takeover", "subdomains", "dns", "httpx", "nuclei"],
     "entryPoint": "trigger_1",
     "nodeCount": 8,
     "edgeCount": 10
@@ -67,6 +53,7 @@
                   "label": "Authorization notes",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Program scope, exclusions, and rate-limit notes."
                 }
               ]
@@ -140,10 +127,7 @@
           "label": "Resolve CNAME and Address Records",
           "config": {
             "params": {
-              "recordTypes": [
-                "A",
-                "CNAME"
-              ],
+              "recordTypes": ["A", "CNAME"],
               "outputMode": "json",
               "includeResponses": true,
               "threads": 100,
@@ -192,18 +176,10 @@
               "followRedirects": true,
               "updateTemplates": true,
               "disableHttpx": true,
-              "severityFilter": [
-                "info",
-                "low",
-                "medium",
-                "high",
-                "critical"
-              ]
+              "severityFilter": ["info", "low", "medium", "high", "critical"]
             },
             "inputOverrides": {
-              "templatePaths": [
-                "http/takeovers/"
-              ]
+              "templatePaths": ["http/takeovers/"]
             }
           }
         }
diff --git a/backend/scripts/seed-templates/web-api-fuzz-triage.json b/backend/scripts/seed-templates/web-api-fuzz-triage.json
@@ -50,13 +50,15 @@
                   "label": "Scan intensity",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "safe",
                   "description": "Use safe, normal, or thorough. Safe caps the wordlist for live triage."
                 },
                 {
                   "id": "authorizationNotes",
                   "label": "Authorization notes",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "",
                   "description": "Program scope, exclusions, rate limits, and validation notes to include in the report."
                 }
               ]
diff --git a/backend/scripts/seed-templates/web-attack-surface-quick-win-hunt.json b/backend/scripts/seed-templates/web-attack-surface-quick-win-hunt.json
@@ -3,14 +3,7 @@
     "name": "Web Attack Surface Quick Win Hunt",
     "description": "Authorized bug bounty workflow that refreshes live web metadata, crawls endpoints, runs safe exposure checks, reviews TLS posture, and writes a prioritized quick-win lead report.",
     "category": "bug-bounty",
-    "tags": [
-      "bug-bounty",
-      "web",
-      "nuclei",
-      "katana",
-      "tls",
-      "quick-wins"
-    ],
+    "tags": ["bug-bounty", "web", "nuclei", "katana", "tls", "quick-wins"],
     "author": "sentris-team",
     "version": "1.0.0"
   },
@@ -20,14 +13,7 @@
     "version": "1.0.0",
     "author": "sentris-team",
     "category": "bug-bounty",
-    "tags": [
-      "bug-bounty",
-      "web",
-      "nuclei",
-      "katana",
-      "tls",
-      "quick-wins"
-    ],
+    "tags": ["bug-bounty", "web", "nuclei", "katana", "tls", "quick-wins"],
     "entryPoint": "trigger_1",
     "nodeCount": 10,
     "edgeCount": 15
@@ -67,6 +53,7 @@
                   "label": "Scan intensity",
                   "type": "text",
                   "required": false,
+                  "defaultValue": "safe",
                   "description": "Operator note such as safe, normal, or thorough."
                 }
               ]
@@ -208,13 +195,7 @@
               "followRedirects": true,
               "updateTemplates": true,
               "disableHttpx": true,
-              "severityFilter": [
-                "info",
-                "low",
-                "medium",
-                "high",
-                "critical"
-              ]
+              "severityFilter": ["info", "low", "medium", "high", "critical"]
             },
             "inputOverrides": {
               "templateIds": [
diff --git a/backend/src/templates/__tests__/seed-templates.spec.ts b/backend/src/templates/__tests__/seed-templates.spec.ts
@@ -86,6 +86,31 @@ describe('new seed templates', () => {
     expect(unboundedSubfinderNodes).toEqual([]);
   });
 
+  it('defines string defaults for optional text runtime inputs', () => {
+    const missingDefaults: string[] = [];
+
+    for (const fileName of newTemplateFiles) {
+      const filePath = join(seedTemplatesDir, fileName);
+      const template = JSON.parse(readFileSync(filePath, 'utf8'));
+      const entrypoint = template.graph.nodes.find(
+        (node: { id: string }) => node.id === 'trigger_1',
+      );
+      const runtimeInputs = entrypoint?.data.config.params.runtimeInputs ?? [];
+
+      for (const runtimeInput of runtimeInputs) {
+        const inputType = String(runtimeInput.type ?? '');
+        const isOptionalTextInput =
+          runtimeInput.required !== true && ['text', 'textarea', 'string'].includes(inputType);
+
+        if (isOptionalTextInput && typeof runtimeInput.defaultValue !== 'string') {
+          missingDefaults.push(`${fileName}:${runtimeInput.id}`);
+        }
+      }
+    }
+
+    expect(missingDefaults).toEqual([]);
+  });
+
   for (const fileName of newTemplateFiles) {
     it(`${fileName} exists and contains a valid workflow graph`, () => {
       const filePath = join(seedTemplatesDir, fileName);

Original file line number	Diff line number	Diff line change
`@@ -53,13 +53,15 @@`
`53`	`53`	`"label": "Scan intensity",`
`54`	`54`	`"type": "text",`
`55`	`55`	`"required": false,`
	`56`	`+ "defaultValue": "safe",`
`56`	`57`	`"description": "Use safe or thorough. Safe keeps candidate generation tightly bounded."`
`57`	`58`	`},`
`58`	`59`	`{`
`59`	`60`	`"id": "authorizationNotes",`
`60`	`61`	`"label": "Authorization notes",`
`61`	`62`	`"type": "text",`
`62`	`63`	`"required": false,`
	`64`	`+ "defaultValue": "",`
`63`	`65`	`"description": "Program scope, exclusions, and rate-limit notes to copy into the report."`
`64`	`66`	`}`
`65`	`67`	`]`
Original file line number	Diff line number	Diff line change
`@@ -43,6 +43,7 @@`
`43`	`43`	`"label": "Authorization notes",`
`44`	`44`	`"type": "text",`
`45`	`45`	`"required": false,`
	`46`	`+ "defaultValue": "",`
`46`	`47`	`"description": "Program scope, exclusions, and rate-limit notes."`
`47`	`48`	`}`
`48`	`49`	`]`
Original file line number	Diff line number	Diff line change
`@@ -46,20 +46,23 @@`
`46`	`46`	`"label": "Product",`
`47`	`47`	`"type": "text",`
`48`	`48`	`"required": false,`
	`49`	`+ "defaultValue": "",`
`49`	`50`	`"description": "Optional product name or technology under review."`
`50`	`51`	`},`
`51`	`52`	`{`
`52`	`53`	`"id": "version",`
`53`	`54`	`"label": "Version",`
`54`	`55`	`"type": "text",`
`55`	`56`	`"required": false,`
	`57`	`+ "defaultValue": "",`
`56`	`58`	`"description": "Optional deployed or suspected affected version."`
`57`	`59`	`},`
`58`	`60`	`{`
`59`	`61`	`"id": "deploymentNotes",`
`60`	`62`	`"label": "Deployment notes",`
`61`	`63`	`"type": "text",`
`62`	`64`	`"required": false,`
	`65`	`+ "defaultValue": "",`
`63`	`66`	`"description": "Internal context for authorized impact analysis."`
`64`	`67`	`}`
`65`	`68`	`]`
Original file line number	Diff line number	Diff line change
`@@ -46,6 +46,7 @@`
`46`	`46`	`"label": "Authorization notes",`
`47`	`47`	`"type": "text",`
`48`	`48`	`"required": false,`
	`49`	`+ "defaultValue": "",`
`49`	`50`	`"description": "Scope notes and rate limits for the engagement."`
`50`	`51`	`}`
`51`	`52`	`]`
Original file line number	Diff line number	Diff line change
`@@ -80,6 +80,7 @@`
`80`	`80`	`"label": "Branch, tag, or commit",`
`81`	`81`	`"type": "text",`
`82`	`82`	`"required": false,`
	`83`	`+ "defaultValue": "",`
`83`	`84`	`"description": "Git ref to read manifests from. Uses the repository default branch when omitted."`
`84`	`85`	`},`
`85`	`86`	`{`
`@@ -101,6 +102,7 @@`
`101`	`102`	`"label": "Research notes",`
`102`	`103`	`"type": "text",`
`103`	`104`	`"required": false,`
	`105`	`+ "defaultValue": "",`
`104`	`106`	`"description": "Program scope, repository context, or triage notes to include in the report."`
`105`	`107`	`}`
`106`	`108`	`]`
Original file line number	Diff line number	Diff line change
`@@ -57,13 +57,15 @@`
`57`	`57`	`"label": "Scan intensity",`
`58`	`58`	`"type": "text",`
`59`	`59`	`"required": false,`
	`60`	`+ "defaultValue": "safe",`
`60`	`61`	`"description": "Use safe, normal, or thorough. Safe keeps passive expansion and DNS queries tightly bounded."`
`61`	`62`	`},`
`62`	`63`	`{`
`63`	`64`	`"id": "authorizationNotes",`
`64`	`65`	`"label": "Authorization notes",`
`65`	`66`	`"type": "text",`
`66`	`67`	`"required": false,`
	`68`	`+ "defaultValue": "",`
`67`	`69`	`"description": "Program scope, exclusions, rate limits, and validation notes to include in the report."`
`68`	`70`	`}`
`69`	`71`	`]`
Original file line number	Diff line number	Diff line change
`@@ -46,13 +46,15 @@`
`46`	`46`	`"label": "Branch, tag, or commit",`
`47`	`47`	`"type": "text",`
`48`	`48`	`"required": false,`
	`49`	`+ "defaultValue": "",`
`49`	`50`	`"description": "Git ref to inspect. Uses the repository default branch when omitted."`
`50`	`51`	`},`
`51`	`52`	`{`
`52`	`53`	`"id": "authorizationNotes",`
`53`	`54`	`"label": "Authorization notes",`
`54`	`55`	`"type": "text",`
`55`	`56`	`"required": false,`
	`57`	`+ "defaultValue": "",`
`56`	`58`	`"description": "Program scope, exclusions, and rate-limit notes to include in the report."`
`57`	`59`	`}`
`58`	`60`	`]`