projectdiscovery / projectdiscovery/alterx

alterx silently ignores -l when stdin is a pipe, and hangs forever when that pipe is empty

Open
#296 0 comments 0 reactions 1 assignee View on GitHub

@dwisiswant0 is already working on this.

Since Sep 16, 2026.

Dominant language
Go
Stars
1k
Forks
78
PR merge metrics
No merged PRs in 30d

Description

Summary

When stdin is a pipe, alterx ignores -l/-list entirely. Two consequences:

  1. Silent data loss — if stdin has data, -l is discarded without a warning and only stdin is processed.
  2. Indefinite hang — if stdin is an open pipe that never sends data (the normal situation when alterx is invoked from a script, cron job, or as a subprocess), alterx blocks forever instead of falling back to -l.

This differs from httpx, which merges both sources.

Reproduce
printf 'api.example.com\ndev.example.com\nstaging.example.com\n' > in.txt

1. -l is silently discarded when stdin has data

# -l alone
alterx -l in.txt -limit 100000 -silent </dev/null | wc -l
# 1842   — all derived from example.com

# stdin alone
printf 'zzz.other.com\n' | alterx -limit 100000 -silent | wc -l
# 696    — all derived from other.com

# both together
printf 'zzz.other.com\n' | alterx -l in.txt -limit 100000 -silent | grep -c 'example\.com'
# 0      — every result comes from stdin; in.txt contributed nothing

No warning is printed. A pipeline that passes -l and happens to have data on stdin silently processes the wrong input.

2. Hangs when stdin is open but empty

# stdin redirected — completes instantly
alterx -l in.txt -limit 10 -silent </dev/null
# exit 0, 10 results

# stdin inherited from a parent process that holds it open — hangs forever
alterx -l in.txt -limit 10 -silent > out.txt
# no output, no error, no timeout

This is the common case when alterx runs inside a shell script or is spawned by another program, which is how most people use it.

Comparison with httpx
printf 'example.com\nexample.org\n' > two.txt
printf 'scanme.sh\n' | httpx -l two.txt -silent -nc
# https://example.com
# https://example.org
# https://scanme.sh          <- merged: 2 from -l + 1 from stdin

printf 'zzz.other.com\n' | alterx -l two.txt -limit 100 -silent
# only permutations of zzz.other.com   <- -l dropped
Expected

Either behaviour would be fine, as long as it is consistent and never silent:

  • merge stdin with -l, as httpx does; or
  • have -l take precedence and skip the stdin read entirely; or
  • at minimum, log a warning when stdin overrides -l, and don't block on stdin when -l is set.

The hang in particular seems worth avoiding regardless: if -l was supplied, there is no reason to wait on stdin.

Possibly related

#110 ("Severe process hangs") describes hangs "in a call to it from an external program" and was closed without a reproduction. Being called from an external program is exactly the condition that triggers case 2 above, so this may be the same underlying cause.

Environment
alterx v0.1.0 (reported as latest)
Linux 7.1.5 x86_64
go install github.com/projectdiscovery/alterx/cmd/alterx@latest

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.