Harden scan robustness and tests

common/parsers/host_iterator_test.go

@@ -2,6 +2,7 @@ package parsers
 
 import (
 	"context"
+	"errors"
 	"os"
 	"reflect"
 	"strings"
@@ -103,3 +104,65 @@ func TestHostIteratorReadsLongHostFileLine(t *testing.T) {
 		t.Fatalf("batch = %#v, want long host", batch)
 	}
 }
+
+func TestMultiHostSourceAndMatcherCIDR(t *testing.T) {
+	src := &multiHostSource{sources: []hostSource{
+		&singleHostSource{host: "192.168.1.1"},
+		&singleHostSource{host: "192.168.1.2"},
+	}}
+
+	host, ok, err := src.Next()
+	if err != nil || !ok || host != "192.168.1.1" {
+		t.Fatalf("first Next = %q/%v/%v", host, ok, err)
+	}
+	host, ok, err = src.Next()
+	if err != nil || !ok || host != "192.168.1.2" {
+		t.Fatalf("second Next = %q/%v/%v", host, ok, err)
+	}
+	host, ok, err = src.Next()
+	if err != nil || ok || host != "" {
+		t.Fatalf("exhausted Next = %q/%v/%v", host, ok, err)
+	}
+	if err := src.Close(); err != nil {
+		t.Fatalf("Close error = %v", err)
+	}
+
+	matcher := newHostMatcher()
+	if err := matcher.add("192.168.1.0/30,example.com"); err != nil {
+		t.Fatalf("matcher add error = %v", err)
+	}
+	if !matcher.match("192.168.1.1") || !matcher.match("192.168.1.2") || !matcher.match("example.com") {
+		t.Fatal("matcher should match CIDR hosts and exact host")
+	}
+	if matcher.match("192.168.1.3") || matcher.match("nope.example") {
+		t.Fatal("matcher matched hosts outside its rules")
+	}
+	if err := matcher.add("2001:db8::/126"); err == nil {
+		t.Fatal("IPv6 CIDR should be rejected by IPv4-only matcher")
+	}
+}
+
+func TestCloseHostSourcesIgnoresCloseErrors(t *testing.T) {
+	first := &closeTrackingSource{err: errors.New("close failed")}
+	second := &closeTrackingSource{}
+
+	closeHostSources([]hostSource{first, second})
+
+	if !first.closed || !second.closed {
+		t.Fatalf("sources closed = %v/%v, want both true", first.closed, second.closed)
+	}
+}
+
+type closeTrackingSource struct {
+	closed bool
+	err    error
+}
+
+func (s *closeTrackingSource) Next() (string, bool, error) {
+	return "", false, nil
+}
+
+func (s *closeTrackingSource) Close() error {
+	s.closed = true
+	return s.err
+}

common/parsers/parse_test.go

@@ -386,6 +386,15 @@ func TestParsePort_PortGroups(t *testing.T) {
 	}
 }
 
+func TestParsePortGroupsRequireWholeToken(t *testing.T) {
+	if got := ParsePort("web8080"); len(got) != 0 {
+		t.Fatalf("ParsePort(web8080) = %v, want empty invalid token", got)
+	}
+	if got := ParsePort("web,8080"); len(got) == 0 || got[len(got)-1] != 28018 {
+		t.Fatalf("ParsePort(web,8080) = %v, want expanded web group", got)
+	}
+}
+
 // TestParsePort_WhitespaceHandling 测试空格处理
 func TestParsePort_WhitespaceHandling(t *testing.T) {
 	tests := []struct {

common/parsers/parsers.go

@@ -200,11 +200,14 @@ func parsePortRange(rangeStr string) []int {
 // expandPortGroups 展开端口组
 func expandPortGroups(ports string) string {
 	portGroups := config.GetPortGroups()
-	result := ports
-	for group, portList := range portGroups {
-		result = strings.ReplaceAll(result, group, portList)
+	parts := strings.Split(ports, ",")
+	for i, part := range parts {
+		token := strings.TrimSpace(part)
+		if portList, ok := portGroups[token]; ok {
+			parts[i] = portList
+		}
 	}
-	return result
+	return strings.Join(parts, ",")
 }
 
 // =============================================================================