TypeError in Target.add() when a hostless entry is batched with an explicitly-masked single address
bbot/scanner/target.py:117 sorts event seeds using a hostless sentinel of (0, 0):
event_seeds = sorted(event_seeds, key=lambda e: (0, 0) if not e.host else host_size_key(str(e.host)))host_size_key() returns a (size, str) tuple, and for an explicitly-masked single address the size is 0:
| input | host_size_key() |
|---|---|
1.2.3.4/32 |
(0, '1.2.3.4/32') |
dead::beef/128 |
(0, 'dead::beef/128') |
1.2.3.4 |
(-1, '1.2.3.4/32') |
1.2.3.0/24 |
(-8, '1.2.3.0/24') |
example.com |
(11, 'example.com') |
So when a hostless seed (BLACKLIST_REGEX) is batched with a /32 or /128 in the same add() call, the sizes tie and Python falls through to comparing 0 against a str.
Reproducer
from bbot.scanner.target import ScanBlacklist
ScanBlacklist("RE:test", "1.2.3.4/32")File "bbot/scanner/target.py", line 117, in add
TypeError: '<' not supported between instances of 'int' and 'str'This is also reachable without writing RE: at all, because bbot/presets/spider.yml ships a blacklist regex:
bbot -t example.com -p spider --blacklist 1.2.3.4/32Scope
Only /32 and /128 collide with the sentinel. Bare addresses, larger CIDRs, and hostnames all have a non-zero size, so they never tie. Both entries must also land in the same add() call, which is why test_blacklist_regex misses it: it adds its RE: entry via a separate .add().
Present in stable. Introduced in f83189bc9.
Fix
The sentinel should be (0, "") so the second element is always a string.
Source: blacklanternsecurity/bbot