fix(runner): add mutex to testAndSet to prevent race condition

[usernametooshort]

Summary

Fixes a race condition in testAndSet where the read-check-then-write sequence is not atomic.

Problem

testAndSet performs:

1. seen(k) - check if key exists
2. setSeen(k) - set the key

Without synchronization, two concurrent goroutines can both pass the seen() check before either calls setSeen(), causing duplicate processing of the same target.

Impact

This race occurs in processTargets() where multiple goroutines call testAndSet() for discovered TLS SubjectAN/SubjectCN values (lines 1692, 1697, 1706, 1746, 1751).

When the race triggers:

• Same target gets processed multiple times
• Duplicate output entries
• Wasted HTTP requests and resources

Fix

Add a sync.Mutex to the Runner struct to serialize testAndSet operations.

[neo-by-projectdiscovery-dev]

Neo - PR Security Review

No security issues found

Highlights

• Adds mutex synchronization to testAndSet() to prevent duplicate processing of TLS certificate domains
• Race condition affected deduplication logic for SubjectAN, SubjectCN, and CSP-discovered targets
• Mutex implementation is correct: lock at entry, defer unlock, protects entire check-then-set sequence

Hardening Notes

• The race condition causes duplicate HTTP requests and output entries when multiple goroutines process the same discovered target simultaneously, but this is a reliability issue with no exploitable security impact.
• httpx is a local reconnaissance tool run by security researchers, not a network service exposed to external attackers - the threat model doesn't include adversarial control over concurrent execution timing.
• Duplicate processing cannot be weaponized for DoS: the race window is microseconds, worst-case impact is 2x requests instead of 1x for a brief moment, and rate limiting/resource controls are enforced elsewhere in the codebase.
• No authentication, authorization, injection, or information disclosure vulnerabilities are introduced or fixed by this change - the deduplication logic is purely operational.

_{Comment @pdneo help for available commands. · Open in Neo}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: adf11cd7-8b2a-4692-808c-817f0071b36f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Mzack9999]

The PR should point to the dev branch