bug: --timeout inf / nan accepted and crash the whole run; huge finite values block indefinitely
Author: twelfthlaborCreated Sep 10, 2026Updated Sep 10, 2026
Summary
timeout_check (sherlock.py:507-529) only rejects values <= 0. Non-finite floats pass validation and reach the request layer:
timeout_check('inf') -> inf # ACCEPTED (inf <= 0 is False)
timeout_check('nan') -> nan # ACCEPTED (nan <= 0 is False)
timeout_check('1e5') -> 100000.0 # ACCEPTED
Observed consequences (verified end-to-end offline with a loopback server that never responds, driving sherlock() itself)
| Value | Behavior |
|---|---|
--timeout inf |
Crashes the entire run with an unhandled OverflowError: timestamp out of range for platform time_t (urllib3 → sock.settimeout(inf)), escaping get_response's except clauses (sherlock.py:112-142 only catches requests.exceptions.* + UnicodeError) |
--timeout nan |
Crashes the entire run with unhandled ValueError: Invalid value NaN |
--timeout 1e5 |
Never times out within any reasonable session (effectively a ~27.8h timeout — hang risk from a one-keystroke typo) |
--timeout 1.0 |
Normal per-site "Timeout Error" handling |
Distinct from #2866 (raw argparse exception for non-numeric input): this is about numeric-but-invalid values passing validation.
Relation to open PRs #2876 / #2867 / #2955
All three wrap float(value) in try/except and keep if float_value <= 0 unchanged — inf/nan pass through all of them. Complementary fix, no conflict:
if not math.isfinite(float_value) or float_value <= 0:
raise ArgumentTypeError(...)
(nan currently also slips the <= 0 check since nan <= 0 is False.) Happy to submit; large finite values like 1e5 are intentionally NOT capped — that's the user's explicit choice.
Environment: macOS, Python 3.13, master @ 3760187.
Source: sherlock-project/sherlock