Add dynamic random string generator for modules

[Aarush289]

Proposed change

This PR introduces support for dynamic placeholders {rand_str(n)} in module templates, allowing random strings of configurable length to be generated at runtime.

This is useful for implementing modules that require unpredictable parameters or tokens, such as cve_2025_64446, where static values may be filtered or cached by the target.

Type of change

• New core framework functionality

Checklist

• I've followed the contributing guidelines
• I've run make pre-commit, it didn't generate any changes
• I've run make test, all tests passed locally

[coderabbitai]

Summary by CodeRabbit

• New Features
  • Templates now support dynamic runtime placeholders (e.g., {rand_str(n)}); these are automatically replaced with generated random tokens when templates are processed.
  • Placeholder processing is applied before final template formatting, ensuring generated values are available to the formatted output.

Walkthrough

Adds runtime placeholder processing to TemplateLoader: a private _apply_dynamic_placeholders(content: str) method replaces patterns like {rand_str(n)} with generated random tokens, and format() now applies this processing before performing template string formatting.

Changes

Cohort / File(s)	Summary
Template Placeholder Enhancement nettacker/core/template.py	Adds _apply_dynamic_placeholders(self, content: str) -> str to replace {rand_str(n)} via common_utils.generate_random_token using re. Updates format() to run this helper on file content prior to .format(). Imports re and common_utils adjusted.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding support for dynamic random string generation in module templates.
Description check	✅ Passed	The description is directly related to the changeset, explaining the purpose of {rand_str(n)} placeholders and their use case in modules.
Merge Conflict Detection	✅ Passed	✅ No merge conflicts detected when merging into master

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

No actionable comments were generated in the recent review. 🎉

🧹 Recent nitpick comments

nettacker/core/template.py (1)

38-43: Silent capping may hide template authoring mistakes — consider logging a warning or raising.

When a template specifies e.g. {rand_str(1024)}, the value is silently truncated to 256 characters. The module author gets no feedback that their requested length was ignored, which can make debugging difficult. A warning log (or a ValueError as previously suggested) would surface the problem early.

🛡️ Suggested improvement

+        import logging
+        logger = logging.getLogger(__name__)
+
         def _rand_str_replacer(match):
-            length = min(
-                int(match.group(1)),
-                256,  # maximum length allowed in rand_str
-            )
+            length = int(match.group(1))
+            if length > 256:
+                raise ValueError(
+                    f"rand_str length {length} exceeds maximum allowed length of 256"
+                )
             return common_utils.generate_random_token(length)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@nettacker/core/template.py`:
- Around line 32-42: Clamp and validate the captured length in
_apply_dynamic_placeholders before passing it to
common_utils.generate_random_token: parse int(m.group(1)), enforce a reasonable
max (e.g. MAX_RAND_STR_LEN = 256) and either cap the requested length or raise a
clear ValueError when it exceeds the cap; update the lambda so it performs this
check and returns a safe-length random token (using
common_utils.generate_random_token) to avoid accidental large allocations from
templates like {rand_str(999999)}.

[Aarush289]

@securestep9 Can you please review the PR

[securestep9]

@codex review this PR using skill: https://github.com/nettacker-codex-ai/skills/blob/main/pr-review-recommender/SKILL.md

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 09788d5569

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add tests for dynamic placeholder expansion

This introduces a new template-preprocessing path without any test coverage, so regressions involving replacement, the 256-character cap, multiple placeholders, or coexistence with ordinary placeholders such as {target} can pass unnoticed. Add focused tests under tests/core/ for the new formatting behavior.

AGENTS.md reference: AGENTS.md:L27-L30

Useful? React with 👍 / 👎.

[Aarush289]

I will add tests once this is merged