#3120·sherlock

bug: --timeout inf / nan accepted and crash the whole run; huge finite values block indefinitely

Author: twelfthlaborCreated Sep 10, 2026Updated Sep 10, 2026

Summary

timeout_check (sherlock.py:507-529) only rejects values <= 0. Non-finite floats pass validation and reach the request layer:

timeout_check('inf') -> inf    # ACCEPTED (inf <= 0 is False)
timeout_check('nan') -> nan    # ACCEPTED (nan <= 0 is False)
timeout_check('1e5') -> 100000.0  # ACCEPTED

Observed consequences (verified end-to-end offline with a loopback server that never responds, driving sherlock() itself)

Value Behavior
--timeout inf Crashes the entire run with an unhandled OverflowError: timestamp out of range for platform time_t (urllib3 → sock.settimeout(inf)), escaping get_response's except clauses (sherlock.py:112-142 only catches requests.exceptions.* + UnicodeError)
--timeout nan Crashes the entire run with unhandled ValueError: Invalid value NaN
--timeout 1e5 Never times out within any reasonable session (effectively a ~27.8h timeout — hang risk from a one-keystroke typo)
--timeout 1.0 Normal per-site "Timeout Error" handling

Distinct from #2866 (raw argparse exception for non-numeric input): this is about numeric-but-invalid values passing validation.

Relation to open PRs #2876 / #2867 / #2955

All three wrap float(value) in try/except and keep if float_value <= 0 unchangedinf/nan pass through all of them. Complementary fix, no conflict:

if not math.isfinite(float_value) or float_value <= 0:
    raise ArgumentTypeError(...)

(nan currently also slips the <= 0 check since nan <= 0 is False.) Happy to submit; large finite values like 1e5 are intentionally NOT capped — that's the user's explicit choice.

Environment: macOS, Python 3.13, master @ 3760187.

Source: sherlock-project/sherlock