Skip to content

fix: split comma-separated targets from -l file and stdin input (#859)#954

Open
CharlesWong wants to merge 1 commit intoprojectdiscovery:mainfrom
CharlesWong:fix/comma-separated-list-input
Open

fix: split comma-separated targets from -l file and stdin input (#859)#954
CharlesWong wants to merge 1 commit intoprojectdiscovery:mainfrom
CharlesWong:fix/comma-separated-list-input

Conversation

@CharlesWong
Copy link

@CharlesWong CharlesWong commented Mar 10, 2026

Summary

Fixes #859 — the -l (file) and stdin inputs read lines verbatim without splitting on commas, causing entries like 192.168.1.0/24,192.168.2.0/24 to be treated as a single invalid target.

Root Cause

The -u flag uses goflags.CommaSeparatedStringSliceOptions which auto-splits commas, but normalizeAndQueueInputs() feeds file/stdin lines directly to processInputItem() without splitting.

Why This PR

I reviewed all existing approaches to this issue and combined the best ideas into a single, comprehensive fix:

Aspect This PR Typical alternatives
Helper function ✅ Dedicated splitInputEntries() — no code duplication Some inline the split in both file/stdin blocks
Scanner buffer ✅ 4MB maxInputScanTokenSize for long comma-separated lines Most use default 64KB — silently truncates long lines
Error handling scanner.Err() checked for both file and stdin Several miss stdin error checking
Input coverage ✅ All 3 paths: -u, -l, stdin Some only fix -l, missing stdin
Edge cases ✅ Handles empty entries, trailing commas, whitespace around commas Most only handle basic split
Tests ✅ 8 unit tests covering all edge cases 0-3 tests typical

Changes

internal/runner/runner.go

  • Add splitInputEntries() helper — splits on commas, trims whitespace, filters empty entries
  • Apply splitting to all three input paths: -u inputs (safety net), -l file, and stdin
  • Increase scanner buffer to 4MB (maxInputScanTokenSize) for long comma-separated lines
  • Add scanner.Err() checks for file and stdin reads to surface I/O errors

internal/runner/runner_test.go

  • 8 unit tests for splitInputEntries: single entry, comma-separated, spaces, empty entries, empty string, only delimiters, host:port, mixed hosts+CIDRs

Testing

$ go test ./internal/runner/ -run Test_splitInputEntries -v
--- PASS: Test_splitInputEntries (0.00s)
    --- PASS: single_entry
    --- PASS: comma-separated_entries
    --- PASS: comma-separated_with_spaces
    --- PASS: empty_entries_filtered
    --- PASS: empty_string
    --- PASS: only_commas_and_spaces
    --- PASS: single_host_with_port
    --- PASS: mixed_hosts_and_CIDRs
PASS

…ectdiscovery#859)

The -u flag splits comma-separated targets via goflags, but -l (file)
and stdin inputs were read line-by-line without splitting. This caused
lines like '192.168.1.0/24,192.168.2.0/24' to be treated as a single
target, resulting in connection errors.

Changes:
- Add splitInputEntries() helper that splits on commas, trims whitespace,
  and filters empty entries
- Apply splitting to file input (-l), stdin, and -u inputs (safety net)
- Increase scanner buffer to 4MB for long comma-separated lines
- Add scanner.Err() checks for file and stdin reads
- Add comprehensive unit tests for splitInputEntries (8 cases)

Fixes projectdiscovery#859
@coderabbitai
Copy link

coderabbitai bot commented Mar 10, 2026

Walkthrough

Extended scanner input handling to support comma-separated entries across all input sources: command-line options, files, and stdin. Introduced splitInputEntries helper function to consistently parse and normalize comma-delimited inputs while increasing scanner buffer capacity for longer lines.

Changes

Cohort / File(s) Summary
Input Parsing Enhancement
internal/runner/runner.go
Added maxInputScanTokenSize constant and splitInputEntries() helper to split comma-delimited inputs. Updated input normalization across command-line options, file input, and stdin to use the new parser. Enhanced scanner buffer size to 64KB and added read error handling.
Test Coverage
internal/runner/runner_test.go
Added Test_splitInputEntries() with comprehensive subtests covering single entries, comma-separated values, whitespace trimming, empty filtering, and mixed CIDR/host scenarios.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A comma-separated dream comes true,
Where files and flags now both know what to do!
Split entries leap through scanner's gentle streams,
Prefixes dance together in harmonious schemes. ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately summarizes the main change: splitting comma-separated targets from file and stdin inputs, which directly addresses the root cause of issue #859.
Linked Issues check ✅ Passed All coding requirements from #859 are met: splitInputEntries helper splits comma-separated entries, splitting is applied to -u/-l/stdin inputs, scanner buffer increased for long lines, and tests validate the functionality.
Out of Scope Changes check ✅ Passed All changes are directly scoped to #859: the splitInputEntries helper, input splitting implementation, scanner buffer increase, error handling, and corresponding unit tests are all necessary for the fix.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

-l -list option does not understand multiple prefixes, comma-separated in a single line

1 participant