[dexhunter]

TL;DR

• Reduce repeated URL decomposition and hostname validation in _normalize_and_parse, preserving fail-closed scope decisions.
• Optimize CIDR rejection under domain-only scope, exercised by TestHuntCliNonExecution::test_cidr_target_with_domain_only_scope_blocked.
• Measure workload wall time with the frozen evaluator: median of three confirmation runs, each using nine alternating baseline/candidate pairs.
• Median sample time: 130.967 ms → 93.657 ms; median paired ratio 0.7174, or 28.3% lower runtime.
• Validation: python -m pytest -q tests/ passed all 1,153 tests; the harness oracle and 87,706 supplemental differential parsing cases passed.

Summary

CIDR scope enforcement parses each expanded host before deciding whether recon may proceed. The parser repeatedly decomposed simple authorities and attempted generic IP parsing for ordinary domain names.

Use urlsplit for ordinary paths, with urlparse preserving semicolon parameter handling. Reuse the parsed authority when it contains no host delimiters, and retain the standard hostname and port properties for complex authorities. Select IPv4Address or IPv6Address directly and avoid allocating domain labels for valid IPv4 inputs. Domain validation still rejects empty labels and ambiguous numeric or hexadecimal endings. Host lowercasing, including IPv6 zone IDs, remains intact.

The patch changes _normalize_and_parse and adds the standard-library urlsplit import. It adds no dependency, persistent cache, or manually constructed IP object.

Measurement

The workload follows tests/test_scope_enforcement_paths.py::TestHuntCliNonExecution::test_cidr_target_with_domain_only_scope_blocked: production run_recon rejects four /24 CIDRs under domain-only scope, with subprocess execution guarded. Additional observations cover scope explanations, URL filtering, host/port extraction, and malformed inputs. Each timed sample repeats the workload 12 times. These are workload timings, not isolated parser-call or pytest-suite timings.

Python 3.12.13; an isolated benchmark core; parent-observed wall clock; fresh seeded inputs; alternating baseline/candidate order; exact outputs compared with a separate pristine-baseline oracle. Imports and scope construction occur outside timing. The metric is scope_checker__normalize_and_parse_time_ratio.

Confirmation run	Baseline sample	Patched sample	Paired time ratio
1	130.967 ms	93.657 ms	0.7174
2	130.241 ms	94.107 ms	0.7250
3	131.302 ms	93.617 ms	0.7121

Absolute headline times are medians of the three run medians; the headline ratio is the median of the three paired-ratio scores. All three scores are below 0.95, clearing the frozen 5% noise threshold. Relative IQR was 0.86–1.89%. The completed search produced 11 distinct valid candidates. Step 7 was the fastest accepted candidate and was exported and rescored without source edits.

Type

• Performance optimization
• Bug fix
• New feature / scanner module
• Methodology improvement
• Documentation
• False positive reduction

Test Plan

• pytest tests/ passes locally: 1,153 passed on both baseline and patched copies.
• No hardcoded targets, API keys, or real domain names added.
• Scanner additions use [CONFIRMED] / [POSSIBLE] / [INFORMATIONAL] confidence states — not applicable.
• New functionality has at least one regression test — no new functionality; existing scope regressions pass.

Supplemental local differential checks matched baseline result types, values, and exceptions across 87,706 inputs, including signed, underscored, Unicode and out-of-range ports; mixed-case IPv6 zone IDs; userinfo; semicolon paths; malformed hosts; and seeded numeric hosts. The frozen-evaluator replay passed all 12 controls with no hash differences.

The separately supplied command, python -m pytest -q tests/test_token_scanner.py tests/test_verifier.py bughunter/tools/zendesk_idor_test.py tests/test_scope_hardening.py, reports 174 passed and two setup errors on both baseline and patched code. The operational Zendesk functions require an undefined my_user_id fixture. The repository's configured tests/ suite passes.

Related Issue

None. No issue is targeted. No open PR touched this file when checked.

Evidence (for methodology changes)

Not applicable; this changes parser performance.

AI assistance

This PR was prepared with AI assistance from Aiden. Candidates were tracked with Weco Observe.

Weco share link: https://dashboard.weco.ai/share/ElKwYEsvS8k599rgEHqgwZtZP87fxpJ0