Enhancement: Add no-target-count limit to validate_target and scan budget to report generation

[techmore]

Type

enhancement

Severity

medium

Area

nmapui/validation.py, nmapui/workflows.py

Description

Two related resource-exhaustion gaps:

1. No limit on comma-separated targets

validate_target() accepts unlimited comma-separated targets. A client could submit thousands of targets causing massive scan fan-out:

targets = [item.strip() for item in target.split(",")]
# No len(targets) check

2. No global scan budget in recursive subnet splitting

_scan_subnets_with_fallback in workflows.py allows recursion to max_depth=4. Starting from a /16, initial chunking produces 256 /24s, each of which could fan out to 16 sub-scans (4096 total nmap invocations). There is no overall scan count or time budget.

Proposed Fix

1. Add a target count limit: if len(targets) > 50: return False, "Too many targets (max 50)"
2. Add a scan invocation counter to the report task that aborts after a configurable maximum (e.g., 100 nmap invocations per report).

Related Issues

#171 (Investigate scan timeout limits — closed)
#209 (Break generate_report_task into staged pipeline)