[Phantom9869]

Fixes the High and Medium findings from the security review. Low findings are unchanged. python -m pytest -q — 155 passed.

Fixes

High

• Cross-host redirects. gambit.http.request no longer uses allow_redirects=True. A redirect is followed only when the next URL is http/https, the hostname matches, and every resolved address is globally routable (ipaddress.is_global). Chains stop at 5 hops. A followed redirect records the final URL on the finding. The first request to a user-specified private target is still allowed.
  • Tests: test_cross_host_redirect_is_not_followed, test_same_host_redirect_to_a_private_address_is_not_followed, test_same_host_redirect_followed_when_address_is_public, test_redirect_chain_is_capped, test_run_records_final_url_after_a_same_host_redirect.

Medium

• Report injection. Text reports collapse control characters so evidence cannot forge a new heading. Markdown additionally HTML-escapes &, <, > and backslash-escapes markdown specials. JSON stays raw.

  • Test: test_text_and_markdown_strip_injected_markup_json_keeps_it.

• TLS re-check dropping the cert. After CERT_NONE, an empty getpeercert() is recovered from getpeercert(binary_form=True) via a temporary PEM and ssl._ssl._test_decode_cert, so expiry is still graded.

  • Tests: test_getpeercert_empty_dict_is_recovered_from_der, test_handshake_reads_binary_cert_when_getpeercert_returns_empty.

• IPv6 host:port parsing. Bare IPv6 is bracketed in normalize_host. split_host_port returns the unbracketed address plus an in-range port. URLs re-bracket only real IPv6 literals. example.com:notaport is unchanged.

  • Tests: test_split_host_port_ipv6_and_out_of_range_ports, test_ipv6_literal_is_bracketed_in_the_url.

• Preflight port vs URL port. An open non-default port (8443, 8080, …) is remembered and used on later URLs. 443 and 80 stay scheme defaults. An explicit port on the target always wins.

  • Test: test_preflight_open_alt_port_is_used_in_the_url.

• Explicit port sent to DNS, and port wrap. DNS, crt.sh, and CNAME queries use the hostname with the port stripped. Ports outside 1–65535 are rejected before getaddrinfo can wrap them (99999 → 34463). A valid explicit port is probed in addition to the standard list.

  • Tests: test_dns_and_crtsh_drop_an_explicit_port, test_out_of_range_port_does_not_connect, test_explicit_port_is_probed_and_out_of_range_port_is_not, test_connect_refuses_a_port_that_would_wrap.

• Unbounded response bodies. Non-streaming responses are read through iter_content and capped at 1 MiB (max_bytes for callers that want less). Caller stream=True is left unread. crt.sh fetches do not follow redirects.

  • Test: test_response_body_is_capped.

• Takeover fingerprint false positives. A fingerprint match counts only when status is missing or ≥ 400, so a live HTTP 200 is not HIGH. NXDOMAIN is HIGH only for services marked claimable. Generic IIS, GitLab, and WordPress strings are no longer fingerprints. Existing GitHub NXDOMAIN and “status omitted” cases stay HIGH.

  • Tests: test_fingerprint_on_http_200_is_not_high_and_404_still_is, test_unclaimable_nxdomain_and_generic_iis_text_are_not_high.

• Dependency pins and pip-audit. pyproject.toml and requirements.txt pin dnspython==2.8.0, requests==2.34.2, and urllib3==2.8.0. CI installs pip-audit and audits requirements.txt.

  • Test: test_runtime_dependencies_are_pinned_and_ci_audits_them.

• Socket connect DNS timeouts. gambit.net.connect resolves with dnspython lifetime and dials the IP, so socket.create_connection does not call getaddrinfo on a hostname before the timeout starts. Used by the liveness preflight, the port scan, and the TLS handshake.

  • Tests: test_connect_resolves_with_a_deadline_then_dials_the_ip, test_public_address_check_rejects_metadata_and_private_ranges.