Skip to content

fix: support comma-separated inputs in list file (-l option) #963

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
zhaog100 wants to merge 1 commit into from
Closed

fix: support comma-separated inputs in list file (-l option) #963

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion internal/runner/runner.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -440,7 +440,11 @@ func (r *Runner) normalizeAndQueueInputs(inputs chan taskInput) error {
for scanner.Scan() {
text := scanner.Text()
if text != "" {
r.processInputItem(text, inputs)
for _, item := range strings.Split(text, ",") {
if item != "" {
r.processInputItem(item, inputs)
}
}
Comment on lines +443 to +447
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Trim comma-split targets and surface scan failures.

Line 443 splits by comma but keeps surrounding whitespace, so entries like 192.168.1.0/24, 192.168.2.0/24 still send an invalid leading-space token to processInputItem. Also, file scan errors are not returned, so input processing can fail silently.

💡 Proposed fix 
 		scanner := bufio.NewScanner(file)
 		for scanner.Scan() {
-			text := scanner.Text()
-			if text != "" {
-				for _, item := range strings.Split(text, ",") {
-					if item != "" {
-						r.processInputItem(item, inputs)
-					}
-				}
-			}
+			text := strings.TrimSpace(scanner.Text())
+			if text == "" {
+				continue
+			}
+			for _, item := range strings.Split(text, ",") {
+				item = strings.TrimSpace(item)
+				if item == "" {
+					continue
+				}
+				r.processInputItem(item, inputs)
+			}
 		}
+		if err := scanner.Err(); err != nil {
+			return errkit.Wrap(err, "could not read input file")
+		}
 	}
As per coding guidelines, "Use ProjectDiscovery libraries (dnsx, fastdialer, goflags, gologger) and ProjectDiscovery's utils/errors for consistent error handling patterns".
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
for _, item := range strings.Split(text, ",") {
if item != "" {
r.processInputItem(item, inputs)
}
}
scanner := bufio.NewScanner(file)
for scanner.Scan() {
text := strings.TrimSpace(scanner.Text())
if text == "" {
continue
}
for _, item := range strings.Split(text, ",") {
item = strings.TrimSpace(item)
if item == "" {
continue
}
r.processInputItem(item, inputs)
}
}
if err := scanner.Err(); err != nil {
return errkit.Wrap(err, "could not read input file")
}
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@internal/runner/runner.go` around lines 443 - 447, When splitting
comma-separated targets in the input handling loop, trim whitespace from each
token before calling r.processInputItem so tokens like " 192.168.2.0/24" are
normalized (use strings.TrimSpace on each item); additionally propagate and
return any errors encountered while scanning files instead of swallowing
them—update the code paths that call file scanning (the scanner loop around
r.processInputItem and any file-read helpers) to capture scan errors and return
a wrapped error using the ProjectDiscovery utils/errors package and consistent
logging with gologger (reference r.processInputItem and the file scan/scan loop)
so failures are surfaced to the caller.

}
}
}
Expand Down