fix: harden scan edge cases

common/config_builder.go

@@ -49,7 +49,10 @@ func BuildConfig(fv *FlagVars, info *HostInfo) (*Config, *State, error) {
 
 func parseCredentials(fv *FlagVars, cfg *Config) error {
 	// 解析用户名
-	usernames := parseUsernames(fv)
+	usernames, err := parseUsernames(fv)
+	if err != nil {
+		return err
+	}
 	if len(usernames) > 0 {
 		for serviceName := range cfg.Credentials.Userdict {
 			cfg.Credentials.Userdict[serviceName] = usernames
@@ -57,7 +60,10 @@ func parseCredentials(fv *FlagVars, cfg *Config) error {
 	}
 
 	// 解析密码
-	passwords := parsePasswords(fv)
+	passwords, err := parsePasswords(fv)
+	if err != nil {
+		return err
+	}
 	if len(passwords) > 0 {
 		cfg.Credentials.Passwords = passwords
 	}
@@ -84,7 +90,7 @@ func parseCredentials(fv *FlagVars, cfg *Config) error {
 	return nil
 }
 
-func parseUsernames(fv *FlagVars) []string {
+func parseUsernames(fv *FlagVars) ([]string, error) {
 	var usernames []string
 
 	// 命令行用户名
@@ -102,7 +108,7 @@ func parseUsernames(fv *FlagVars) []string {
 		if lines, err := parsers.ReadLinesFromFile(fv.UsersFile); err == nil {
 			usernames = append(usernames, lines...)
 		} else {
-			LogError(i18n.Tr("config_read_users_failed", fv.UsersFile, err))
+			return nil, fmt.Errorf("%s", i18n.Tr("config_read_users_failed", fv.UsersFile, err))
 		}
 	}
 
@@ -116,15 +122,15 @@ func parseUsernames(fv *FlagVars) []string {
 		}
 	}
 
-	return removeDuplicate(usernames)
+	return removeDuplicate(usernames), nil
 }
 
-func parsePasswords(fv *FlagVars) []string {
+func parsePasswords(fv *FlagVars) ([]string, error) {
 	var passwords []string
 
 	// 命令行密码
 	if fv.Password != "" {
-		passwords = append(passwords, splitCredentialValues(fv.Password)...)
+		passwords = append(passwords, fv.Password)
 	}
 
 	// 从文件读取
@@ -132,7 +138,7 @@ func parsePasswords(fv *FlagVars) []string {
 		if lines, err := parsers.ReadLinesFromFile(fv.PasswordsFile); err == nil {
 			passwords = append(passwords, lines...)
 		} else {
-			LogError(i18n.Tr("config_read_passwords_failed", fv.PasswordsFile, err))
+			return nil, fmt.Errorf("%s", i18n.Tr("config_read_passwords_failed", fv.PasswordsFile, err))
 		}
 	}
 
@@ -141,7 +147,7 @@ func parsePasswords(fv *FlagVars) []string {
 		passwords = append(passwords, splitCredentialValues(fv.AddPasswords)...)
 	}
 
-	return removeDuplicate(passwords)
+	return removeDuplicate(passwords), nil
 }
 
 func splitCredentialValues(input string) []string {
@@ -192,12 +198,15 @@ func parseHashes(fv *FlagVars) ([]string, [][]byte, error) {
 	// 命令行哈希
 	if fv.HashValue != "" {
 		hash := strings.TrimSpace(fv.HashValue)
-		if len(hash) == 32 {
-			hashValues = append(hashValues, hash)
-			if hashByte, err := hex.DecodeString(hash); err == nil {
-				hashBytes = append(hashBytes, hashByte)
-			}
+		if len(hash) != 32 {
+			return nil, nil, fmt.Errorf("invalid hash length: %s", hash)
 		}
+		hashByte, err := hex.DecodeString(hash)
+		if err != nil {
+			return nil, nil, err
+		}
+		hashValues = append(hashValues, hash)
+		hashBytes = append(hashBytes, hashByte)
 	}
 
 	// 从文件读取
@@ -225,13 +234,17 @@ func parseTargets(fv *FlagVars, info *HostInfo, cfg *Config, state *State) error
 			if port, portErr := strconv.Atoi(portStr); portErr == nil && port >= 1 && port <= 65535 {
 				// 有效的 host:port 格式
 				state.SetHostPorts([]string{info.Host})
+				info.Host = ""
 				ports = "" // 清空端口，避免双重扫描
 			}
 		}
 	}
 
 	// 解析 URL
-	urls := parseURLs(fv)
+	urls, err := parseURLs(fv)
+	if err != nil {
+		return err
+	}
 	if len(urls) > 0 {
 		state.SetURLs(urls)
 		if info.URL == "" && len(urls) == 1 {
@@ -247,7 +260,7 @@ func parseTargets(fv *FlagVars, info *HostInfo, cfg *Config, state *State) error
 	return nil
 }
 
-func parseURLs(fv *FlagVars) []string {
+func parseURLs(fv *FlagVars) ([]string, error) {
 	var urls []string
 
 	// 命令行 URL
@@ -267,11 +280,11 @@ func parseURLs(fv *FlagVars) []string {
 				urls = append(urls, normalizeURL(line))
 			}
 		} else {
-			LogError(i18n.Tr("config_read_urls_failed", fv.URLsFile, err))
+			return nil, fmt.Errorf("%s", i18n.Tr("config_read_urls_failed", fv.URLsFile, err))
 		}
 	}
 
-	return removeDuplicate(urls)
+	return removeDuplicate(urls), nil
 }
 
 func normalizeURL(rawURL string) string {
@@ -279,7 +292,8 @@ func normalizeURL(rawURL string) string {
 	if rawURL == "" {
 		return rawURL
 	}
-	if !strings.HasPrefix(rawURL, "http://") && !strings.HasPrefix(rawURL, "https://") {
+	lowerURL := strings.ToLower(rawURL)
+	if !strings.HasPrefix(lowerURL, "http://") && !strings.HasPrefix(lowerURL, "https://") {
 		return "http://" + rawURL
 	}
 	return rawURL