projectdiscovery / projectdiscovery/alterx
alterx silently ignores -l when stdin is a pipe, and hangs forever when that pipe is empty
@dwisiswant0 is already working on this.
Since Sep 16, 2026.
- Dominant language
- Go
- Stars
- 1k
- Forks
- 78
- PR merge metrics
- No merged PRs in 30d
Description
Summary
When stdin is a pipe, alterx ignores -l/-list entirely. Two consequences:
- Silent data loss — if stdin has data,
-lis discarded without a warning and only stdin is processed. - Indefinite hang — if stdin is an open pipe that never sends data (the normal situation when alterx is invoked from a script, cron job, or as a subprocess), alterx blocks forever instead of falling back to
-l.
This differs from httpx, which merges both sources.
Reproduce
printf 'api.example.com\ndev.example.com\nstaging.example.com\n' > in.txt
1. -l is silently discarded when stdin has data
# -l alone
alterx -l in.txt -limit 100000 -silent </dev/null | wc -l
# 1842 — all derived from example.com
# stdin alone
printf 'zzz.other.com\n' | alterx -limit 100000 -silent | wc -l
# 696 — all derived from other.com
# both together
printf 'zzz.other.com\n' | alterx -l in.txt -limit 100000 -silent | grep -c 'example\.com'
# 0 — every result comes from stdin; in.txt contributed nothing
No warning is printed. A pipeline that passes -l and happens to have data on stdin silently processes the wrong input.
2. Hangs when stdin is open but empty
# stdin redirected — completes instantly
alterx -l in.txt -limit 10 -silent </dev/null
# exit 0, 10 results
# stdin inherited from a parent process that holds it open — hangs forever
alterx -l in.txt -limit 10 -silent > out.txt
# no output, no error, no timeout
This is the common case when alterx runs inside a shell script or is spawned by another program, which is how most people use it.
Comparison with httpx
printf 'example.com\nexample.org\n' > two.txt
printf 'scanme.sh\n' | httpx -l two.txt -silent -nc
# https://example.com
# https://example.org
# https://scanme.sh <- merged: 2 from -l + 1 from stdin
printf 'zzz.other.com\n' | alterx -l two.txt -limit 100 -silent
# only permutations of zzz.other.com <- -l dropped
Expected
Either behaviour would be fine, as long as it is consistent and never silent:
- merge stdin with
-l, as httpx does; or - have
-ltake precedence and skip the stdin read entirely; or - at minimum, log a warning when stdin overrides
-l, and don't block on stdin when-lis set.
The hang in particular seems worth avoiding regardless: if -l was supplied, there is no reason to wait on stdin.
Possibly related
#110 ("Severe process hangs") describes hangs "in a call to it from an external program" and was closed without a reproduction. Being called from an external program is exactly the condition that triggers case 2 above, so this may be the same underlying cause.
Environment
alterx v0.1.0 (reported as latest)
Linux 7.1.5 x86_64
go install github.com/projectdiscovery/alterx/cmd/alterx@latest
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.