owasp-amass / amass

In-depth attack surface mapping and asset discovery
https://owasp.org/www-project-amass/
Other
11.78k stars 1.86k forks source link

Fixed panic during output (should hopefully fix #800) #887

Open UFeindschiff opened 1 year ago

UFeindschiff commented 1 year ago

Currently processOutput() is writing only references of the objects to output to the different output channels (text, json, print). However, the saveTextOutput() function actually modifies that data structure which causes a concurrent json marshal on the same data structure to panic as the data being marsheled is modified by another thread.

This PR proposes deep copies of the output objects being written into the different output channels as it seems to me to be the most sane solution.

The alternatives would have been to either have output mutex-locked, which would still have the disadvantage of saveTextOutput() modifying the data, so you would have a different output depending on whether or not saveTextOutput() happened to run prior or later than your current output as it modifies the data. The other alternative would have been to just modify saveTextOutput(), but that isn't future-proof as in the future someone might write a new output function or modify an existing one in a way that it modifies the data again which would cause everything to break all over again.

I know creating a deep copy through json.Marshal() and json.Unmarshal() is not the most elegant way of creating a deep copy, but it shouldn't cause too much overhead compared to writing functions to do that manually using reflections.