fix(scanner): path-traversal hardening, NS-takeover detection, resource/race fixes

From an adversarial audit of internal/scanner/** (21 confirmed findings).
Fixes all HIGH + MEDIUM issues.

HIGH — path traversal (arbitrary file write + dir deletion):
Every scanner built its output dir as filepath.Join(resultsDir, <target>) where
the target (domain/subdomain/bucket/repo) was never stripped of '/' or '..'. Since
filepath.Join cleans the path, a target like "../../../../tmp/x" escaped the
results dir; the subdomain scan's end-of-run cleanup (RemoveAll) made it an
arbitrary-directory-deletion primitive, reachable from the unauthenticated-by-
default scan API.
- New utils.SanitizeTargetSegment(): collapses a target to one safe path segment
  (no separators, no ".."). Applied in utils.ResultsDir and at every direct
  path-build site: subdomain, nuclei, gf, sqlmap, dalfox, githubscan, backup,
  domain, ports, s3, asr, dns, misconfig, cnames, jsendpoints, urls, zerodays,
  exposure, depconfusion.
- Regression test asserts no sanitized segment can contain a separator/".." and
  cannot escape via filepath.Join.

HIGH — NS-takeover detection was dead code (dns.go):
runNSTakeover built its resolver with dnsx.DefaultOptions, which only queries A
records, so result.NS was always empty and NS takeovers were never detected.
Now configures QuestionTypes=[]uint16{dns.TypeNS} so the NS section is populated.

MEDIUM:
- jsscan: cap remote JS body with io.LimitReader(10MB) — unbounded io.ReadAll
  across ~100 workers could exhaust memory.
- cnames: on timeout, snapshot cnameRecords under the mutex before reading
  (workers could still append → data race).
- asr/dns_asr: puredns I/O used fixed /tmp filenames shared across runs; now uses
  a per-invocation os.MkdirTemp dir so concurrent ASR scans don't corrupt
  each other.

go mod tidy promotes miekg/dns (now used directly) and gjson to direct deps.

CI replicated locally: CGO_ENABLED=1 go vet/build/test all pass; new utils tests
and backup tests pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: h0tak88r

go.mod

@@ -21,6 +21,7 @@ require (
 	github.com/joeguo/tldextract v0.0.0-20220507100122-d83daa6adef8
 	github.com/juju/persistent-cookiejar v1.0.0
 	github.com/majd/ipatool/v2 v2.2.0
+	github.com/miekg/dns v1.1.68
 	github.com/projectdiscovery/dnsx v1.2.2
 	github.com/projectdiscovery/goflags v0.1.74
 	github.com/projectdiscovery/httpx v1.8.1
@@ -35,6 +36,7 @@ require (
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.10.2
 	github.com/sw33tLie/bbscope v0.0.0-20251113222800-c453973e83dd
+	github.com/tidwall/gjson v1.18.0
 	go.opentelemetry.io/otel v1.38.0
 	go.opentelemetry.io/otel/sdk v1.38.0
 	go.opentelemetry.io/otel/trace v1.38.0
@@ -285,7 +287,6 @@ require (
 	github.com/mholt/archives v0.1.5 // indirect
 	github.com/microcosm-cc/bluemonday v1.0.27 // indirect
 	github.com/microsoft/go-mssqldb v1.9.2 // indirect
-	github.com/miekg/dns v1.1.68 // indirect
 	github.com/mikelolasagasti/xz v1.0.1 // indirect
 	github.com/minio/minlz v1.0.1 // indirect
 	github.com/minio/selfupdate v0.6.1-0.20230907112617-f11e74f84ca7 // indirect
@@ -388,7 +389,6 @@ require (
 	github.com/syndtr/goleveldb v1.0.0 // indirect
 	github.com/tidwall/btree v1.8.1 // indirect
 	github.com/tidwall/buntdb v1.3.2 // indirect
-	github.com/tidwall/gjson v1.18.0 // indirect
 	github.com/tidwall/grect v0.1.4 // indirect
 	github.com/tidwall/match v1.2.0 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect

internal/scanner/asr/internal/dns_asr/dns.go

@@ -96,11 +96,14 @@ func (c *Client) BruteforceWithWordlistFile(ctx context.Context, domain, wordlis
 // ---- puredns implementations (fast, for large lists) ----
 
 func (c *Client) resolveWithPuredns(ctx context.Context, domains []string, threads int) ([]string, error) {
-	tmpDir := os.TempDir()
-	inputFile := filepath.Join(tmpDir, "asr_resolve_input.txt")
-	outputFile := filepath.Join(tmpDir, "asr_resolve_output.txt")
-	defer os.Remove(inputFile)
-	defer os.Remove(outputFile)
+	// Per-invocation temp dir so concurrent ASR scans don't clobber each other's I/O.
+	tmpDir, err := os.MkdirTemp("", "asr-resolve-")
+	if err != nil {
+		return nil, fmt.Errorf("failed to create temp dir: %w", err)
+	}
+	defer os.RemoveAll(tmpDir)
+	inputFile := filepath.Join(tmpDir, "input.txt")
+	outputFile := filepath.Join(tmpDir, "output.txt")
 
 	// Write domains to temp file
 	if err := writeLines(inputFile, domains); err != nil {
@@ -125,9 +128,12 @@ func (c *Client) resolveWithPuredns(ctx context.Context, domains []string, threa
 }
 
 func (c *Client) bruteforceWithPuredns(ctx context.Context, domain string, wordlist []string, threads int) ([]string, error) {
-	tmpDir := os.TempDir()
-	wordlistFile := filepath.Join(tmpDir, "asr_bruteforce_wordlist.txt")
-	defer os.Remove(wordlistFile)
+	tmpDir, err := os.MkdirTemp("", "asr-bruteforce-")
+	if err != nil {
+		return nil, fmt.Errorf("failed to create temp dir: %w", err)
+	}
+	defer os.RemoveAll(tmpDir)
+	wordlistFile := filepath.Join(tmpDir, "wordlist.txt")
 
 	if err := writeLines(wordlistFile, wordlist); err != nil {
 		return nil, fmt.Errorf("failed to write wordlist file: %w", err)
@@ -137,9 +143,12 @@ func (c *Client) bruteforceWithPuredns(ctx context.Context, domain string, wordl
 }
 
 func (c *Client) bruteforceFileWithPuredns(ctx context.Context, domain, wordlistPath string, threads int) ([]string, error) {
-	tmpDir := os.TempDir()
-	outputFile := filepath.Join(tmpDir, "asr_bruteforce_output.txt")
-	defer os.Remove(outputFile)
+	tmpDir, err := os.MkdirTemp("", "asr-bruteforce-out-")
+	if err != nil {
+		return nil, fmt.Errorf("failed to create temp dir: %w", err)
+	}
+	defer os.RemoveAll(tmpDir)
+	outputFile := filepath.Join(tmpDir, "output.txt")
 
 	args := []string{"bruteforce", wordlistPath, domain, "-w", outputFile}
 	if c.resolvers != "" {

internal/scanner/asr/modes.go

@@ -26,7 +26,7 @@ func RunMode1(ctx context.Context, opts Options) error {
 	opts.Progress(fmt.Sprintf("Found %d passive subdomains", len(subs)))
 
 	resultsRoot := utils.GetResultsDir()
-	domainDir := filepath.Join(resultsRoot, opts.Domain)
+	domainDir := filepath.Join(resultsRoot, utils.SanitizeTargetSegment(opts.Domain))
 	os.MkdirAll(domainDir, 0755)
 
 	return utils.WriteLines(filepath.Join(domainDir, "all_subs_passive.txt"), subs)
@@ -37,7 +37,7 @@ func RunMode2(ctx context.Context, opts Options) error {
 	opts.Progress("Running Mode 2: DNS Bruteforce + TLS Probing + Permutations")
 
 	resultsRoot := utils.GetResultsDir()
-	domainDir := filepath.Join(resultsRoot, opts.Domain)
+	domainDir := filepath.Join(resultsRoot, utils.SanitizeTargetSegment(opts.Domain))
 	os.MkdirAll(domainDir, 0755)
 
 	var allSubdomains []string
@@ -76,7 +76,7 @@ func RunMode3(ctx context.Context, opts Options) error {
 	opts.Progress("Running Mode 3: Passive + TLS + DNS Bruteforce + HTTP Check + Scraping")
 
 	resultsRoot := utils.GetResultsDir()
-	domainDir := filepath.Join(resultsRoot, opts.Domain)
+	domainDir := filepath.Join(resultsRoot, utils.SanitizeTargetSegment(opts.Domain))
 	os.MkdirAll(domainDir, 0755)
 
 	var allSubdomains []string
@@ -137,7 +137,7 @@ func RunMode4(ctx context.Context, opts Options) error {
 	opts.Progress("Running Mode 4: Passive + TLS + HTTP Check + Scraping (No DNS Bruteforce)")
 
 	resultsRoot := utils.GetResultsDir()
-	domainDir := filepath.Join(resultsRoot, opts.Domain)
+	domainDir := filepath.Join(resultsRoot, utils.SanitizeTargetSegment(opts.Domain))
 	os.MkdirAll(domainDir, 0755)
 
 	var allSubdomains []string
@@ -185,7 +185,7 @@ func RunMode5(ctx context.Context, opts Options) error {
 	opts.Progress("Running Mode 5: Full Recon")
 
 	resultsRoot := utils.GetResultsDir()
-	domainDir := filepath.Join(resultsRoot, opts.Domain)
+	domainDir := filepath.Join(resultsRoot, utils.SanitizeTargetSegment(opts.Domain))
 	os.MkdirAll(domainDir, 0755)
 
 	var allSubdomains []string

internal/scanner/backup/backup.go

@@ -77,8 +77,9 @@ func Run(opts Options) (*Result, error) {
 	outDir := opts.OutputDir
 	if outDir == "" {
 		if opts.Domain != "" {
-			// Sanitize domain for filesystem use (remove protocol, replace : with -)
-			sanitizedDomain := sanitizeDomainForPath(opts.Domain)
+			// Sanitize domain into a single safe path segment (prevents traversal
+			// via a crafted target such as "../../etc").
+			sanitizedDomain := utils.SanitizeTargetSegment(opts.Domain)
 			outDir = filepath.Join(resultsDir, sanitizedDomain, "backup")
 		} else {
 			outDir = filepath.Join(resultsDir, "backup")

internal/scanner/cnames/cnames.go

@@ -11,8 +11,8 @@ import (
 	"sync"
 	"time"
 
-	"github.com/h0tak88r/AutoAR/internal/scanner/subdomains"
 	"github.com/h0tak88r/AutoAR/internal/db"
+	"github.com/h0tak88r/AutoAR/internal/scanner/subdomains"
 	"github.com/h0tak88r/AutoAR/internal/utils"
 	"github.com/projectdiscovery/dnsx/libs/dnsx"
 )
@@ -38,7 +38,7 @@ type Options struct {
 func CollectCNAMEs(domain string) (*Result, error) {
 	return CollectCNAMEsWithOptions(Options{
 		Domain:  domain,
-		Threads: 100,              // Default 100 concurrent DNS queries
+		Threads: 100,             // Default 100 concurrent DNS queries
 		Timeout: 5 * time.Minute, // 5 minute timeout
 	})
 }
@@ -48,7 +48,7 @@ func CollectCNAMEsWithOptions(opts Options) (*Result, error) {
 	// Determine which mode we're in and set targets accordingly
 	var targets []string
 	var domain string
-	
+
 	if len(opts.Targets) > 0 {
 		// Mode 1: Direct targets provided
 		targets = opts.Targets
@@ -77,7 +77,7 @@ func CollectCNAMEsWithOptions(opts Options) (*Result, error) {
 		// Mode 3: Domain provided - enumerate subdomains (original behavior)
 		domain = opts.Domain
 		resultsDir := utils.GetResultsDir()
-		domainDir := filepath.Join(resultsDir, domain)
+		domainDir := filepath.Join(resultsDir, utils.SanitizeTargetSegment(domain))
 		subsDir := filepath.Join(domainDir, "subs")
 		if err := utils.EnsureDir(subsDir); err != nil {
 			return nil, fmt.Errorf("failed to create subs dir: %w", err)
@@ -140,7 +140,7 @@ func CollectCNAMEsWithOptions(opts Options) (*Result, error) {
 
 	// Set up output directory
 	resultsDir := utils.GetResultsDir()
-	domainDir := filepath.Join(resultsDir, domain)
+	domainDir := filepath.Join(resultsDir, utils.SanitizeTargetSegment(domain))
 	subsDir := filepath.Join(domainDir, "subs")
 	if err := utils.EnsureDir(subsDir); err != nil {
 		return nil, fmt.Errorf("failed to create subs dir: %w", err)
@@ -205,7 +205,7 @@ func CollectCNAMEsWithOptions(opts Options) (*Result, error) {
 						cnameRecords = append(cnameRecords, fmt.Sprintf("%s CNAME %s", target, cname))
 					}
 					recordsMutex.Unlock()
-					
+
 					// Sync to core database Subdomains table
 					go db.UpdateSubdomainCNAME(opts.Domain, target, strings.Join(results.CNAME, ","))
 				}
@@ -239,8 +239,15 @@ func CollectCNAMEsWithOptions(opts Options) (*Result, error) {
 		logger.GetLogger().Infof("[WARN] CNAME collection timed out after %v", opts.Timeout)
 	}
 
+	// On timeout some workers may still be appending to cnameRecords, so take a
+	// snapshot under the lock and use it for all reads below (avoids a data race).
+	recordsMutex.Lock()
+	recordsSnapshot := make([]string, len(cnameRecords))
+	copy(recordsSnapshot, cnameRecords)
+	recordsMutex.Unlock()
+
 	// Write results to file
-	if err := writeLines(out, cnameRecords); err != nil {
+	if err := writeLines(out, recordsSnapshot); err != nil {
 		return nil, fmt.Errorf("failed to write CNAME records: %w", err)
 	}
 
@@ -260,8 +267,8 @@ func CollectCNAMEsWithOptions(opts Options) (*Result, error) {
 			Finding   string `json:"finding"`
 		}
 		var entries []cnameEntry
-		seen := make(map[string]struct{}, len(cnameRecords))
-		for _, rec := range cnameRecords {
+		seen := make(map[string]struct{}, len(recordsSnapshot))
+		for _, rec := range recordsSnapshot {
 			// format: "sub.example.com CNAME target.example.com"
 			parts := strings.Fields(rec)
 			if len(parts) >= 3 {

internal/scanner/dalfox/dalfox.go

@@ -33,7 +33,7 @@ func RunDalfox(domain string, threads int) (*Result, error) {
 	}
 
 	resultsDir := utils.GetResultsDir()
-	domainDir := filepath.Join(resultsDir, domain)
+	domainDir := filepath.Join(resultsDir, utils.SanitizeTargetSegment(domain))
 	urlsFile := filepath.Join(domainDir, "urls", "all-urls.txt")
 	inFile := filepath.Join(domainDir, "vulnerabilities", "xss", gf.ResultFileForPattern("xss"))
 	outFile := filepath.Join(domainDir, "dalfox-results.txt")

internal/scanner/depconfusion/depconfusion.go

@@ -124,9 +124,9 @@ func runWebFromFile(opts Options, resultsDir string) error {
 	outputDir := opts.OutputDir
 	if outputDir == "" {
 		if opts.Domain != "" {
-			outputDir = filepath.Join(resultsDir, opts.Domain, "depconfusion", "web-file")
+			outputDir = filepath.Join(resultsDir, utils.SanitizeTargetSegment(opts.Domain), "depconfusion", "web-file")
 		} else if opts.Subdomain != "" {
-			outputDir = filepath.Join(resultsDir, opts.Subdomain, "depconfusion", "web-file")
+			outputDir = filepath.Join(resultsDir, utils.SanitizeTargetSegment(opts.Subdomain), "depconfusion", "web-file")
 		} else {
 			outputDir = filepath.Join(resultsDir, "depconfusion", "web-file")
 		}
@@ -172,7 +172,7 @@ func runWebFull(opts Options, resultsDir string) error {
 		return fmt.Errorf("domain is required for full scan")
 	}
 
-	outputDir := filepath.Join(resultsDir, "depconfusion", fmt.Sprintf("web-full-%s", domain))
+	outputDir := filepath.Join(resultsDir, "depconfusion", fmt.Sprintf("web-full-%s", utils.SanitizeTargetSegment(domain)))
 	if opts.OutputDir != "" {
 		outputDir = opts.OutputDir
 	}
@@ -350,7 +350,7 @@ func runGitHubRepo(opts Options, resultsDir string) error {
 }
 
 func runGitHubOrg(opts Options, resultsDir string) error {
-	outputDir := filepath.Join(resultsDir, "depconfusion", fmt.Sprintf("github-org-%s", opts.GitHubOrg))
+	outputDir := filepath.Join(resultsDir, "depconfusion", fmt.Sprintf("github-org-%s", utils.SanitizeTargetSegment(opts.GitHubOrg)))
 	if opts.OutputDir != "" {
 		outputDir = opts.OutputDir
 	}