Merge testing: resolve 8 project audit findings (security + correctness)

Author: h0tak88r

internal/api/scan_logbus.go

@@ -74,10 +74,16 @@ func (b *logBus) Subscribe(scanID string) (history []string, ch chan string) {
 	history = make([]string, len(stored))
 	copy(history, stored)
 
-	ch = make(chan string, logBusChanSize)
-	if len(b.subs[scanID]) < logBusMaxSubs {
-		b.subs[scanID] = append(b.subs[scanID], ch)
+	if len(b.subs[scanID]) >= logBusMaxSubs {
+		// At the subscriber cap: hand back an already-closed channel so the SSE
+		// loop receives ok=false and tears down cleanly, instead of an orphaned
+		// open channel that Close() can never close (relying on client disconnect).
+		ch = make(chan string)
+		close(ch)
+		return history, ch
 	}
+	ch = make(chan string, logBusChanSize)
+	b.subs[scanID] = append(b.subs[scanID], ch)
 	return history, ch
 }
 

internal/api/scan_results_api.go

@@ -2056,18 +2056,17 @@ func apiGetScanReport(c *gin.Context) {
 	templateName := strings.TrimSpace(c.DefaultQuery("template", "default"))
 	format := strings.ToLower(strings.TrimSpace(c.DefaultQuery("format", "markdown")))
 
-	scanRec, _ := db.GetScan(scanID)
-	target := ""
-	scanType := ""
-	status := "unknown"
+	scanRec, err := db.GetScan(scanID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+	target := scanRec.Target
+	scanType := scanRec.ScanType
+	status := scanRec.Status
 	dateStr := time.Now().UTC().Format("2006-01-02")
-	if scanRec != nil {
-		target = scanRec.Target
-		scanType = scanRec.ScanType
-		status = scanRec.Status
-		if !scanRec.CompletedAt.IsZero() {
-			dateStr = scanRec.CompletedAt.UTC().Format("2006-01-02")
-		}
+	if scanRec.CompletedAt != nil && !scanRec.CompletedAt.IsZero() {
+		dateStr = scanRec.CompletedAt.UTC().Format("2006-01-02")
 	}
 
 	// Build a simple Markdown findings table from parsed results (top 50 rows).

internal/api/scan_runner.go

@@ -52,7 +52,8 @@ func RunScanInProcess(scanID, scanType, target string, fn func() error) {
 		// Without a DB record the scan would be invisible to the UI — abort rather
 		// than run an orphaned scan whose results can never be retrieved.
 		log.Printf("[runner] ABORT: failed to create DB record for %s (%s): %v", scanID, scanType, err)
-		<-scanSemaphore // release slot acquired above
+		// The deferred release above already frees the acquired slot; releasing
+		// again here would unbalance the semaphore (steal another scan's slot).
 		return
 	}
 

internal/api/ui/app.js

@@ -733,6 +733,9 @@ function targetsLaunchScan(domain) {
 async function targetsCopyAll() {
   return callPageMethod('TargetsPage', 'targetsCopyAll');
 }
+async function targetsCopyOne(value) {
+  return callPageMethod('TargetsPage', 'targetsCopyOne', [value]);
+}
 
 // ── Keyhacks ─────────────────────────────────────────────────────────────────
 

internal/api/ui/pages/settings.js

@@ -177,7 +177,7 @@
                 <div class="settings-hint">Where monitor change alerts are sent. Discord webhook URLs work out of the box.</div>
               </div>
               <div class="settings-control">
-                <input type="text" id="monitor-webhook-input" value="${escValue(cfg.monitor_webhook || '')}" placeholder="https://discord.com/api/webhooks/..." class="form-control premium-input">
+                <input type="text" id="monitor-webhook-input" value="" placeholder="${cfg.monitor_webhook_set ? 'Configured — enter a new URL to replace it' : 'https://discord.com/api/webhooks/...'}" class="form-control premium-input">
                 <button class="btn btn-primary" onclick="window.SettingsPage.saveWebhookSettings()">Save</button>
               </div>
             </div>
@@ -362,6 +362,12 @@
     const input = document.getElementById('monitor-webhook-input');
     if (!input) return;
     const webhook = input.value.trim();
+    // The raw webhook is no longer returned by /api/config (it's a secret), so the
+    // field renders empty; an empty submit means "no change" rather than clearing it.
+    if (!webhook) {
+      window.showToast('info', 'No change', 'Enter a webhook URL to set or replace the current one.');
+      return;
+    }
     try {
       const headers = await window.buildAuthHeaders({ 'Content-Type': 'application/json' });
       const res = await fetch('/api/settings', {

internal/api/ui/pages/targets.js

@@ -18,7 +18,15 @@
   };
 
   function escapeSafe(s) {
-    return String(s).replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');
+    // Escapes &, ", <, > AND ' — the single quote matters because these values are
+    // interpolated into single-quoted onclick="fn('...')" string literals; leaving
+    // it unescaped lets a crafted scope target break out and execute JS (XSS).
+    return String(s)
+      .replace(/&/g, '&amp;')
+      .replace(/"/g, '&quot;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/'/g, '&#39;');
   }
 
   function renderPlatformCredFields(p, colors) {
@@ -330,5 +338,6 @@
     targetsAddAllDomains,
     targetsLaunchScan,
     targetsCopyAll,
+    targetsCopyOne,
   };
 })();

internal/api/ui_api.go

@@ -63,7 +63,9 @@ func apiConfigHandler(c *gin.Context) {
 		"auth_provider":   "local",
 		"db_type":         utils.GetEnv("DB_TYPE", "postgresql"),
 		"mode":            utils.GetEnv("AUTOAR_MODE", "api"),
-		"monitor_webhook": os.Getenv("MONITOR_WEBHOOK_URL"),
+		// Secret webhook URL is never returned on this public endpoint — only
+		// whether one is configured (the raw value carries a Discord/Slack token).
+		"monitor_webhook_set": strings.TrimSpace(os.Getenv("MONITOR_WEBHOOK_URL")) != "",
 		"monitor_ai_available": strings.TrimSpace(os.Getenv("OPENROUTER_API_KEY")) != "" ||
 			strings.TrimSpace(os.Getenv("OPENCODE_API_KEY")) != "" ||
 			strings.TrimSpace(os.Getenv("GEMINI_API_KEY")) != "",

internal/scanner/ffuf/ffuf.go

@@ -942,7 +942,7 @@ func RunFFufDomainMode(opts Options) (*Result, error) {
 
 	// Setup output directory
 	resultsDir := utils.GetResultsDir()
-	outputDir := filepath.Join(resultsDir, opts.Domain, "ffuf")
+	outputDir := filepath.Join(resultsDir, utils.SanitizeTargetSegment(opts.Domain), "ffuf")
 	if err := utils.EnsureDir(outputDir); err != nil {
 		return nil, fmt.Errorf("failed to create output directory: %w", err)
 	}
@@ -1194,10 +1194,10 @@ func runFFufSingleTarget(opts Options) (*Result, error) {
 	// Otherwise use the legacy single-target layout:
 	//   {resultsDir}/{subdomain}/ffuf/
 	resultsDir := utils.GetResultsDir()
-	subdomainName := extractDomain(opts.Target)
+	subdomainName := utils.SanitizeTargetSegment(extractDomain(opts.Target))
 	var outputDir string
 	if opts.ParentDomain != "" {
-		outputDir = filepath.Join(resultsDir, opts.ParentDomain, "ffuf", subdomainName)
+		outputDir = filepath.Join(resultsDir, utils.SanitizeTargetSegment(opts.ParentDomain), "ffuf", subdomainName)
 	} else {
 		outputDir = filepath.Join(resultsDir, subdomainName, "ffuf")
 	}