projectdiscovery / nuclei-action Goto Github PK
View Code? Open in Web Editor NEWVulnerability Scan with Nuclei
Home Page: https://projectdiscovery.io/nuclei
License: MIT License
Vulnerability Scan with Nuclei
Home Page: https://projectdiscovery.io/nuclei
License: MIT License
Supporting template URLs should relatively simple to introduce.
Example:
- name: Nuclei - Vulnerability Scan
uses: projectdiscovery/nuclei-action@main
with:
target: https://example.com
templates: https://raw.githubusercontent.com/foo/bar/main/custom-templates.yml
In index.js
, something like this perhaps:
if (templates) {
try {
// URL() constructor will throw if a string is not URL, per https://www.rfc-editor.org/rfc/rfc3986
new URL(templates);
params.push(`-turl=${templates}`);
} catch () {
params.push(`-t=${templates}`);
}
}
If you are OK with this, I can submit a PR.
Hi there,
I am running a scan with about 50k hosts and am receiving a generic error below:
/home/ubuntu/test-scan/_work/_actions/hakrishi/nuclei-automation/master/dist/index.js:1598
error = new Error(`The process '${this.toolPath}' failed with exit code ${this.processExitCode}`);
^
Error: The process '/home/ubuntu/test-scan/_work/_temp/9ce80dba-655e-4b53-a685-7d2de0016a74/nuclei' failed with exit code null
at ExecState._setResult (/home/ubuntu/test-scan/_work/_actions/hakrishi/nuclei-automation/master/dist/index.js:1598:25)
at ExecState.CheckComplete (/home/ubuntu/test-scan/_work/_actions/hakrishi/nuclei-automation/master/dist/index.js:1581:18)
at ChildProcess.<anonymous> (/home/ubuntu/test-scan/_work/_actions/hakrishi/nuclei-automation/master/dist/index.js:1475:27)
at ChildProcess.emit (node:events:527:28)
at maybeClose (node:internal/child_process:1092:16)
at Socket.<anonymous> (node:internal/child_process:451:11)
at Socket.emit (node:events:527:28)
at Pipe.<anonymous> (node:net:709:12)
Just a note: currently I have cloned the nuclei-action repo into my own account therefore I am using:
- name: Nuclei - Vulnerability Scan
uses: hakrishi/nuclei-automation@main
Instead of the default:
- name: Nuclei - Vulnerability Scan
uses: projectdiscovery/nuclei-action@main
Will this affect anything?
Thanks for your help on this!
Rishi
If the nuclei scan has no results no nuclei.sarif
is being created and the GH action fails on the result upload step:
ConfigurationError: Path does not exist: nuclei.sarif
at run (/home/runner/work/_actions/github/codeql-action/v3/lib/upload-sarif-action.js:65:15)
This code is not working,
name: Nuclei-Target-Workflow-Engine
on: [push]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Run Nuclei
uses: projectdiscovery/nuclei-action@main
with:
urls: urls.txt
Showing this error:
[FTL] Could not create runner: could not create input provider: could not open targets file: open ${ /urls.txt }: no such file or directory
/home/runner/work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1598
error = new Error(`The process '${this.toolPath}' failed with exit code ${this.processExitCode}`);
^
Error: The process '/home/runner/work/_temp/9ac62320-4c63-4568-8c74-97f8baa16329/nuclei' failed with exit code 1
at ExecState._setResult (/home/runner/work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1598:[25](https://github.com/Th3BlackHol3/nuclei-target/actions/runs/5733206004/job/15537523842#step:3:27))
at ExecState.CheckComplete (/home/runner/work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1581:18)
at ChildProcess.<anonymous> (/home/runner/work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1475:[27](https://github.com/Th3BlackHol3/nuclei-target/actions/runs/5733206004/job/15537523842#step:3:29))
at ChildProcess.emit (node:events:527:[28](https://github.com/Th3BlackHol3/nuclei-target/actions/runs/5733206004/job/15537523842#step:3:30))
at maybeClose (node:internal/child_process:1092:16)
at Process.ChildProcess._handle.onexit (node:internal/child_process:[30](https://github.com/Th3BlackHol3/nuclei-Manulife/actions/runs/5733206004/job/15537523842#step:3:32)2:5)
my bad, please - close.
Is there any appetite for an update to Node20+, or is there anything fundamentally holding it back?
Does the action need updating?
- name: Nuclei Scan
uses: projectdiscovery/nuclei-action@main
with:
urls: output/active_urls.txt
output: output/nuclei_output.txt
Run projectdiscovery/nuclei-action@main
with:
urls: output/active_urls.txt
output: output/nuclei_output.txt
json: false
include-rr: false
github-report: false
env:
GOROOT: /opt/hostedtoolcache/go/1.14.15/x64
[FTL] Program exiting: no template/templates provided
I'm using the action with custom templates and the option to report findings as GitHub issues.
The issue is that every time my workflow runs (e.g., on push) new issues on the same findings are being created.
Is it possible to not open new issues if an issue already exists? If not, this should only be used on releaae, or what is the optimal trigger for such a workflow?
Hi there,
When using the workflow: ./github/workflow.yml
line, the Action does not pick up the workflow. I noticed this issue only occurs when the workflow file extension is .yml. It works perfectly fine using the .yaml extension. Just thought I raise this issue here.
Kind regards
RIshi
I saw this message in my logs:
The
save-state
command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
Looks like it's not called anywhere directly and is used in a dependency. Should be fixable by bumping @actions/core
to v1.10.0
.
Trying to run this action, and getting no sarif output. Other file debug outputs seem to produce something minimal at least. Ideas?
Partial Github action file:
- name: Nuclei - Vulnerability Scan
uses: projectdiscovery/nuclei-action@main
with:
target: https://example.com
workflows: security-assertions/foo-bar/00-foobar--workflow.yaml
flags: -var EMAIL=${{ matrix.username }} -var PASSWORD=${{ secrets[matrix.password_secret] }}
sarif-export: nuclei.sarif
- name: Print nuclei.sarif File Content
run: cat nuclei.sarif
/home/runner/work/_temp/51b80b73-65d9-4ebf-add6-d816bd351d6f/nuclei -target=https://example.com/ -w=security-assertions/foo-bar/00-foobar--workflow.yaml -se=nuclei.sarif -o=nuclei.log -irr [email protected] -var=***
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.1.10
projectdiscovery.io
[INF] nuclei-templates are not installed, installing...
[INF] Successfully installed nuclei-templates at /home/runner/nuclei-templates
[INF] Current nuclei version: v3.1.10 (latest)
[INF] Current nuclei-templates version: v9.7.6 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] Workflows loaded for current scan: 1
[WRN] Executing 3 unsigned templates. Use with caution.
[INF] Targets loaded for current scan: 1
[INF] No results found. Better luck next time!
cat nuclei.sarif
shell: /usr/bin/bash -e {0}
cat: nuclei.sarif: No such file or directory
Hi guys,
just tried the default example workflow with dshboard alerts nuclei.yaml. But it fails on github/codeql-action/upload-sarif@v2
.
See full error here: https://github.com/schniggie/vuln-mgmt/actions/runs/3383544249
The flags: are not properly used. Without these flags, especially rate limiting, it is very easy to overwhelm a target host.
uses: projectdiscovery/nuclei-action@main
with:
target: https://qa.redacted.com
flags: "-rate-limit 10"
/usr/bin/unzip -o -q /home/runner/work/_temp/41c11ed2-a0e8-483e-9efb-37583970f5e5
Nuclei 2.7.3 was successfully installed to /home/runner/work/_temp/9a5d95b9-d906-4758-b26e-c31067dbc579.
/home/runner/work/_temp/9a5d95b9-d906-4758-b26e-c31067dbc579/nuclei -target=https://qa.deepdyve.com/ -se=nuclei.sarif -rate-limit 10 -o=nuclei.log
flag provided but not defined: -rate-limit 10
Nuclei is a fast, template based vulnerability scanner focusing
on extensive configurability, massive extensibility and ease of use.
Usage:
/home/runner/work/_temp/9a5d95b9-d906-4758-b26e-c31067dbc579/nuclei [flags]
Flags:
TARGET:
-u, -target string[] target URLs/hosts to scan
-l, -list string path to file containing a list of target URLs/hosts to scan (one per line)
-resume string Resume scan using resume.cfg (clustering will be disabled)
TEMPLATES:
-nt, -new-templates run only new templates added in latest nuclei-templates release
-as, -automatic-scan automatic web scan using wappalyzer technology detection to tags mapping
-t, -templates string[] list of template or template directory to run (comma-separated, file)
-tu, -template-url string[] list of template urls to run (comma-separated, file)
-w, -workflows string[] list of workflow or workflow directory to run (comma-separated, file)
-wu, -workflow-url string[] list of workflow urls to run (comma-separated, file)
-validate validate the passed templates to nuclei
-tl list all available templates
FILTERING:
-a, -author string[] templates to run based on authors (comma-separated, file)
-tags string[] templates to run based on tags (comma-separated, file)
-etags, -exclude-tags string[] templates to exclude based on tags (comma-separated, file)
-itags, -include-tags string[] tags to be executed even if they are excluded either by default or configuration
-id, -template-id string[] templates to run based on template ids (comma-separated, file)
-eid, -exclude-id string[] templates to exclude based on template ids (comma-separated, file)
-it, -include-templates string[] templates to be executed even if they are excluded either by default or configuration
-et, -exclude-templates string[] template or template directory to exclude (comma-separated, file)
-s, -severity value[] templates to run based on severity. Possible values: info, low, medium, high, critical, unknown
-es, -exclude-severity value[] templates to exclude based on severity. Possible values: info, low, medium, high, critical, unknown
-pt, -type value[] templates to run based on protocol type. Possible values: dns, file, http, headless, network, workflow, ssl, websocket, whois
-ept, -exclude-type value[] templates to exclude based on protocol type. Possible values: dns, file, http, headless, network, workflow, ssl, websocket, whois
OUTPUT:
-o, -output string output file to write found issues/vulnerabilities
-sresp, -store-resp store all request/response passed through nuclei to output directory
-srd, -store-resp-dir string store all request/response passed through nuclei to custom directory (default "output")
-silent display findings only
-nc, -no-color disable output content coloring (ANSI escape codes)
-json write output in JSONL(ines) format
-irr, -include-rr include request/response pairs in the JSONL output (for findings only)
-nm, -no-meta disable printing result metadata in cli output
-nts, -no-timestamp disable printing timestamp in cli output
-rdb, -report-db string nuclei reporting database (always use this to persist report data)
-ms, -matcher-status display match failure status
-me, -markdown-export string directory to export results in markdown format
-se, -sarif-export string file to export results in SARIF format
CONFIGURATIONS:
-config string path to the nuclei configuration file
-fr, -follow-redirects enable following redirects for http templates
-mr, -max-redirects int max number of redirects to follow for http templates (default 10)
-dr, -disable-redirects disable redirects for http templates
-rc, -report-config string nuclei reporting module configuration file
-H, -header string[] custom header/cookie to include in all http request in header:value format (cli, file)
-V, -var value custom vars in key=value format
-r, -resolvers string file containing resolver list for nuclei
-sr, -system-resolvers use system DNS resolving as error fallback
-passive enable passive HTTP response processing mode
-ev, -env-vars enable environment variables to be used in template
-cc, -client-cert string client certificate file (PEM-encoded) used for authenticating against scanned hosts
-ck, -client-key string client key file (PEM-encoded) used for authenticating against scanned hosts
-ca, -client-ca string client certificate authority file (PEM-encoded) used for authenticating against scanned hosts
-sml, -show-match-line show match lines for file templates, works with extractors only
-ztls use ztls library with autofallback to standard one for tls13
-sni string tls sni hostname to use (default: input domain name)
INTERACTSH:
-iserver, -interactsh-server string interactsh server url for self-hosted instance (default: oast.pro,oast.live,oast.site,oast.online,oast.fun,oast.me)
-itoken, -interactsh-token string authentication token for self-hosted interactsh server
-interactions-cache-size int number of requests to keep in the interactions cache (default 5000)
-interactions-eviction int number of seconds to wait before evicting requests from cache (default 60)
-interactions-poll-duration int number of seconds to wait before each interaction poll request (default 5)
-interactions-cooldown-period int extra time for interaction polling before exiting (default 5)
-ni, -no-interactsh disable interactsh server for OAST testing, exclude OAST based templates
RATE-LIMIT:
-rl, -rate-limit int maximum number of requests to send per second (default 150)
-rlm, -rate-limit-minute int maximum number of requests to send per minute
-bs, -bulk-size int maximum number of hosts to be analyzed in parallel per template (default 25)
-c, -concurrency int maximum number of templates to be executed in parallel (default 25)
-hbs, -headless-bulk-size int maximum number of headless hosts to be analyzed in parallel per template (default 10)
-hc, -headless-concurrency int maximum number of headless templates to be executed in parallel (default 10)
OPTIMIZATIONS:
-timeout int time to wait in seconds before timeout (default 5)
-retries int number of times to retry a failed request (default 1)
-ldp, -leave-default-ports leave default HTTP/HTTPS ports (eg. host:80,host:443
-mhe, -max-host-error int max errors for a host before skipping from scan (default 30)
-project use a project folder to avoid sending same request multiple times
-project-path string set a specific project path (default "/tmp")
-spm, -stop-at-first-path stop processing HTTP requests after the first match (may break template/workflow logic)
-stream stream mode - start elaborating without sorting the input
HEADLESS:
-headless enable templates that require headless browser support (root user on linux will disable sandbox)
-page-timeout int seconds to wait for each page in headless mode (default 20)
-sb, -show-browser show the browser on the screen when running templates with headless mode
-sc, -system-chrome Use local installed chrome browser instead of nuclei installed
DEBUG:
-debug show all requests and responses
-dreq, -debug-req show all sent requests
-dresp, -debug-resp show all received responses
-p, -proxy string[] list of http/socks5 proxy to use (comma separated or file input)
-pi, -proxy-internal proxy all internal requests
-tlog, -trace-log string file to write sent requests trace log
-elog, -error-log string file to write sent requests error log
-version show nuclei version
-hm, -hang-monitor enable nuclei hang monitoring
-v, -verbose show verbose output
-vv display templates loaded for scan
-ep, -enable-pprof enable pprof debugging server
-tv, -templates-version shows the version of the installed nuclei-templates
-health-check run diagnostic check up
UPDATE:
-update update nuclei engine to the latest released version
-ut, -update-templates update nuclei-templates to latest released version
-ud, -update-directory string overwrite the default directory to install nuclei-templates
-duc, -disable-update-check disable automatic nuclei/templates update check
STATISTICS:
-stats display statistics about the running scan
-sj, -stats-json write statistics data to an output file in JSONL(ines) format
-si, -stats-interval int number of seconds to wait between showing a statistics update (default 5)
-m, -metrics expose nuclei metrics on a port
-mp, -metrics-port int port to expose nuclei metrics on (default 9092)
/home/runner/work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1598
error = new Error(`The process '${this.toolPath}' failed with exit code ${this.processExitCode}`);
^
Error: The process '/home/runner/work/_temp/9a5d95b9-d906-4758-b26e-c31067dbc579/nuclei' failed with exit code 2
at ExecState._setResult (/home/runner/work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1598:25)
at ExecState.CheckComplete (/home/runner/work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1581:18)
at ChildProcess.<anonymous> (/home/runner/work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1475:27)
at ChildProcess.emit (node:events:390:28)
at maybeClose (node:internal/child_process:1064:16)
at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5)```
Hi, i've setup the action on a new repo and looks like the action doesnt work anymore with nuclei 2.3.1. Same action code still works in old repo ๐ค
It downloads a bunch of templates but ends with
Nuclei Templates v8.1.5 Changelog
[INF] Successfully downloaded nuclei-templates (v8.1.5). Enjoy!
+-------+-------+---------+
| TOTAL | ADDED | REMOVED |
+-------+-------+---------+
| 738 | 738 | 0 |
+-------+-------+---------+
cp: cannot create regular file 'nuclei-templates/.nuclei-ignore': No such file or directory
Error: Process completed with exit code 1.
I want to see the difference of a website which is behind cloudflare, but can be reached directly too.
I've already tried changing /etc/hosts
like this:
sudo sh -c 'echo "1.1.1.1 example.com" >> /etc/hosts'
sudo sh -c 'echo "1.1.1.1 www.example.com" >> /etc/hosts'
and verified it's working in next steps (which use run
) using curl -ILv example.com
, but I think nuclei-action does not respect changed /etc/hosts
.
I'm not even sure if something can be done to let this GHA action use /etc/hosts
from previous step or another "input" should be added.
hi,
each time I execute the nuclei-action I get this warning.
Warning: CodeQL Action v1 will be deprecated on December 7th, 2022. Please upgrade to v2. For more information, see https://github.blog/changelog/2022-04-27-code-scanning-deprecation-of-codeql-action-v1/ Error: codeql/upload-sarif action failed: HttpError: Resource not accessible by integration
I guess the CodeQL version needs to be updated.
github/codeql-action/upload-sarif@v1
regards.
Hi, team! We infrequently receive an error, maybe ~1-5% of the time:
Error: Cannot read properties of undefined (reading 'replace')
There's only 3 places in the codebase that call .replace
, and I suspect it's the call to getLatestInfo sometimes having a transient error. I think it probably needs a retry, or at least some slightly better error-handling and logging. I can take a stab at it if I have some free cycles next week. Thoughts?
Hey,
Whats the method for ignoring certain templates like the ec2 and waf ones?
Hi,
This is a question I guess. In github actions each job is restricted to run 360 min only ( 6 hours ) and a workflow has a limit of 30 days.
In nuclei let's assume you have a list that contains many assets and several nuclei templates and thats will take more than 6 hours to scan. This will result in terminating nuclei scan when it reaches 6 hours.
Is there any workaround for this? in short terms, I want to scan a big list that usually requires more than 6 hours to complete.
So I installed pd-actions, configured github issue reporting for nuclei but then I was flooded with info
reports. So I added info to deny list in the bug-tracker-config.yaml and used config
input for nuclei-action in pd-actions.yaml. But the nuclei-action tried to copy config file and the action died with error:
cp: cannot create regular file '/.config/nuclei/config.yaml': No such file or directory
Hello, below is the error I am receiving:
[0:51:35] | Templates: 211 | Hosts: 2510 | RPS: 95 | Matched: 0 | Errors: 27076 | Requests: 294794/973880 (30%)
[0:51:40] | Templates: 211 | Hosts: 2510 | RPS: 95 | Matched: 0 | Errors: 27085 | Requests: 294803/973880 (30%)
[0:51:45] | Templates: 211 | Hosts: 2510 | RPS: 94 | Matched: 0 | Errors: 27100 | Requests: 294891/973880 (30%)
/home/ubuntu/rishi/_work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1598
error = new Error(`The process '${this.toolPath}' failed with exit code ${this.processExitCode}`);
^
Error: The process '/home/ubuntu/rishi/_work/_temp/84a23889-b3e1-4cf5-b971-0f06c245741a/nuclei' failed with exit code null
at ExecState._setResult (/home/ubuntu/rishi/_work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1598:25)
at ExecState.CheckComplete (/home/ubuntu/rishi/_work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1581:18)
at ChildProcess.<anonymous> (/home/ubuntu/rishi/_work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1475:27)
at ChildProcess.emit (node:events:513:28)
at maybeClose (node:internal/child_process:1100:16)
at Socket.<anonymous> (node:internal/child_process:458:11)
at Socket.emit (node:events:513:28)
at Pipe.<anonymous> (node:net:301:12)
My workflow starts off with httpx Action then outputs it to Nuclei Action. After running it through httpx action I have 2510 hosts (the error still occurs even when not using httpx in the workflow). My Github Action Workflow file is:
- name: httpX Scan
uses: projectdiscovery/httpx-action@main
with:
list: .github/input/Globe.txt
flags: "-config .github/configurations/httpx/httpx-config.yaml"
- name: Nuclei Scan
uses: projectdiscovery/nuclei-action@main
with:
urls: httpx.log
output: /home/ubuntu/OutputFiles/Globe-Scan1-output.txt
config: .github/configurations/nuclei/main-config.yaml
And the Nuclei config is:
tags: kev
# Optimisations
scan-strategy: host-spray
concurrency: 200
bulk-size: 10
max-host-error: 5
max-redirects: 1
# Misc
stats: true
ts: true```
Happy to provide more info if needed.
Thanks
Rishi
Hi there,
I am testing workflows with Nuclei Action and am faced with the below error which terminates my scan. I've noticed this issue occur in the previous scan I ran, is this a known bug?
[19:22:20] | Templates: 1 | Hosts: 20000 | RPS: 27 | Matched: 0 | Errors: 236095 | Requests: 1928087/2047585 (94%)
[19:22:25] | Templates: 1 | Hosts: 20000 | RPS: 27 | Matched: 0 | Errors: 236101 | Requests: 1928302/2047837 (94%)
[19:22:30] | Templates: 1 | Hosts: 20000 | RPS: 27 | Matched: 0 | Errors: 236110 | Requests: 1928515/2048030 (94%)
[19:22:35] | Templates: 1 | Hosts: 20000 | RPS: 27 | Matched: 0 | Errors: 236113 | Requests: 1928641/2048147 (94%)
/home/ubuntu/Rishi-Testing/_work/_actions/org/nuclei-automation/master/dist/index.js:1598
error = new Error(`The process '${this.toolPath}' failed with exit code ${this.processExitCode}`);
^
Error: The process '/home/ubuntu/Rishi-Testing/_work/_temp/5682e079-6ac0-4e40-9027-d94d34981154/nuclei' failed with exit code null
at ExecState._setResult (/home/ubuntu/Rishi-Testing/_work/_actions/org/nuclei-automation/master/dist/index.js:1598:25)
at ExecState.CheckComplete (/home/ubuntu/Rishi-Testing/_work/_actions/org/nuclei-automation/master/dist/index.js:1581:18)
at ChildProcess.<anonymous> (/home/ubuntu/Rishi-Testing/_work/_actions/org/nuclei-automation/master/dist/index.js:1475:27)
at ChildProcess.emit (node:events:390:28)
at maybeClose (node:internal/child_process:1064:16)
at Socket.<anonymous> (node:internal/child_process:450:11)
at Socket.emit (node:events:390:28)
at Pipe.<anonymous> (node:net:687:12)
Thanks
Currently it looks like the latest version is always installed, which can be problematic when a new version with possibly breaking changes is released.
We just saw our workflow break, apparently because something changed in version 3.0.0
It would be useful to allow passing the desired nuclei version to this action.
I can submit a PR, if this will help
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.