🛡️ Sentinel: [MEDIUM] Fix DoS via bytes bypass in timeout validation

test_testping1.py

@@ -48,7 +48,15 @@ def test_is_reachable_timeout_too_long(self, mock_call):
         """Test is_reachable rejects overly long timeout strings to prevent DoS."""
         with self.assertLogs(level='ERROR') as log:
             self.assertFalse(is_reachable('8.8.8.8', timeout='A' * 101))
-            self.assertIn("Timeout string too long", log.output[0])
+            self.assertIn("Timeout input too long", log.output[0])
+            mock_call.assert_not_called()
+
+    @patch('testping1.subprocess.call')
+    def test_is_reachable_timeout_bytes_too_long(self, mock_call):
+        """Test is_reachable rejects overly long timeout bytes to prevent DoS."""
+        with self.assertLogs(level='ERROR') as log:
+            self.assertFalse(is_reachable('8.8.8.8', timeout=b'1' * 101))
+            self.assertIn("Timeout input too long", log.output[0])
             mock_call.assert_not_called()
 
     @patch('testping1.subprocess.call')
@@ -112,11 +120,11 @@ def test_is_reachable_invalid_timeout(self, mock_call):
         mock_call.assert_not_called()
 
     @patch('testping1.subprocess.call')
-    def test_is_reachable_timeout_too_long(self, mock_call):
-        """Test is_reachable rejects overly long timeout strings to prevent DoS."""
+    def test_is_reachable_timeout_too_long_numeric_string(self, mock_call):
+        """Test is_reachable rejects overly long numeric timeout strings to prevent DoS."""
         with self.assertLogs(level='ERROR') as log:
             self.assertFalse(is_reachable('8.8.8.8', timeout='1' * 101))
-            self.assertIn("Timeout string too long", log.output[0])
+            self.assertIn("Timeout input too long", log.output[0])
             mock_call.assert_not_called()
 
     @patch('testping1.subprocess.call')

testping1.py

@@ -157,8 +157,8 @@ def is_reachable(ip, timeout=1):
     else:
         # 🛡️ Sentinel: Validate timeout length to prevent CPU exhaustion (DoS)
         # Python's int() conversion for massive strings has O(N^2) complexity.
-        if isinstance(timeout, str) and len(timeout) > 100:
-            logging.error("Timeout string too long")
+        if isinstance(timeout, (str, bytes)) and len(timeout) > 100:
+            logging.error("Timeout input too long")
             return False
 
         try: