Fix: Add guard to prevent division by zero at line 2359

The max_bot_traffic variable is extracted from a file which could theoretically contain all zeros, causing division by zero. Added: max_bot_traffic=${max_bot_traffic:-1} This ensures the denominator is never zero while preserving the intended logic when valid data exists.
Fix: Remove UUOC (Useless Use Of Cat) patterns throughout script
2026-04-23 21:27:06 -04:00 · 2026-04-23 21:26:37 -04:00 · 2026-04-23 21:24:47 -04:00 · 2026-04-23 21:20:33 -04:00 · 2026-04-23 21:19:37 -04:00 · 2026-04-23 21:16:33 -04:00
12 changed files with 181 additions and 129 deletions
@@ -419,7 +419,8 @@ if [ "$sent" -gt 0 ] || [ "$received" -gt 0 ]; then
    # Top recipients (delivery recipients from emails in TEMP_MATCHES)
    if [ "$sent" -gt 0 ] || [ "$delivered" -gt 0 ]; then
        print_info "Top 5 recipients (emails delivered TO):"
-        grep -F "$search_pattern" "$TEMP_MATCHES" 2>/dev/null | grep -oE "=> [^@]+@[^ ]+" | sed 's/=> //' | sort | uniq -c | sort -rn | head -5 | while read count recipient; do
+        sed -n "/^$search_pattern/p" "$TEMP_MATCHES" 2>/dev/null | \
+            sed -n 's/.*=> \([^@]*@[^ ]*\).*/\1/p' | sort | uniq -c | sort -rn | head -5 | while read count recipient; do
            [ -n "$count" ] && echo "  $recipient - $count emails"
        done
        echo ""
@@ -428,7 +429,8 @@ if [ "$sent" -gt 0 ] || [ "$received" -gt 0 ]; then
    # Top senders (who is sending emails in TEMP_MATCHES)
    if [ "$sent" -gt 0 ]; then
        print_info "Top 5 senders (emails sent FROM):"
-        grep -F "$search_pattern" "$TEMP_MATCHES" 2>/dev/null | grep -oE "<= [^@]+@[^ ]+" | sed 's/<= //' | sort | uniq -c | sort -rn | head -5 | while read count sender; do
+        sed -n "/^$search_pattern/p" "$TEMP_MATCHES" 2>/dev/null | \
+            sed -n 's/.*<= \([^@]*@[^ ]*\).*/\1/p' | sort | uniq -c | sort -rn | head -5 | while read count sender; do
            [ -n "$count" ] && echo "  $sender - $count emails"
        done
        echo ""
@@ -546,7 +548,7 @@ if [ "$check_type" != "2" ]; then

    # cPanel forwarders (in /etc/valiases)
    if [ -f "/etc/valiases/$domain_part" ]; then
-        forwarder=$(grep -F "^$local_part:" "/etc/valiases/$domain_part" 2>/dev/null)
+        forwarder=$(grep "^${local_part}:" "/etc/valiases/$domain_part" 2>/dev/null || echo "")
        if [ -n "$forwarder" ]; then
            echo ""
            print_info "Forwarder configured:"
@@ -650,7 +652,7 @@ if [ "$delivered" -gt 0 ]; then
        else
            echo "  $line"
        fi
-    done < <(grep -F "$search_pattern" "$TEMP_MATCHES" | grep -iE "=>|delivered" | tail -5)
+    done < <(sed -n "/^$search_pattern/p" "$TEMP_MATCHES" 2>/dev/null | sed -n '/=>\|[Dd]elivered/p' | tail -5)
    echo ""
 fi

@@ -660,7 +662,7 @@ if [ "$bounced" -gt 0 ]; then

    # Get all bounce lines (Issue 4.1: add -- after grep flags)
    TEMP_BOUNCES="/tmp/email_bounces_$$.txt"
-    grep -F -- "$search_pattern" "$TEMP_MATCHES" 2>/dev/null | \
+    sed -n "/^$search_pattern/p" "$TEMP_MATCHES" 2>/dev/null | \
        grep -Ev "authenticator failed|Authentication failed|saved mail to|=>" | \
        grep -iE "550|551|552|553|554|bounced|Mail delivery failed|\\*\\* " > "$TEMP_BOUNCES" 2>/dev/null

@@ -40,14 +40,14 @@ if [ "$MTA" = "exim" ]; then
    print_header "Queue Summary"

    # Exim: exim -bpc returns just the number
-    queue_count=$(eval "$SYS_MAIL_CMD_QUEUE_COUNT")
+    queue_count=$(bash -c "$SYS_MAIL_CMD_QUEUE_COUNT" 2>/dev/null || echo "0")

    if [ "$queue_count" -gt 0 ] 2>/dev/null; then
        print_warning "$queue_count messages in queue"
        echo ""

        # Cache queue list - single execution for all operations
-        queue_list=$(eval "$SYS_MAIL_CMD_QUEUE_LIST")
+        queue_list=$(bash -c "$SYS_MAIL_CMD_QUEUE_LIST" 2>/dev/null || echo "")

        print_header "Recent Queue Messages (last 20)"
        echo "$queue_list" | head -20
@@ -74,7 +74,7 @@ elif [ "$MTA" = "postfix" ]; then
    print_header "Queue Summary"

    # Postfix: mailq | tail -1 returns "-- N Kbytes in M Requests."
-    queue_summary=$(eval "$SYS_MAIL_CMD_QUEUE_COUNT")
+    queue_summary=$(bash -c "$SYS_MAIL_CMD_QUEUE_COUNT" 2>/dev/null || echo "")
    print_info "$queue_summary"

    # Extract message count from summary line (last number is always message count)
@@ -89,7 +89,7 @@ elif [ "$MTA" = "postfix" ]; then
        echo ""

        # Cache queue list - single execution for all operations
-        queue_list=$(eval "$SYS_MAIL_CMD_QUEUE_LIST")
+        queue_list=$(bash -c "$SYS_MAIL_CMD_QUEUE_LIST" 2>/dev/null || echo "")

        print_header "Queue Details (first 50)"
        echo "$queue_list" | head -50
@@ -116,7 +116,7 @@ elif [ "$MTA" = "sendmail" ]; then
    print_header "Queue Summary"

    # Sendmail: mailq | tail -1 returns "-- N Kbytes in M Requests."
-    queue_summary=$(eval "$SYS_MAIL_CMD_QUEUE_COUNT")
+    queue_summary=$(bash -c "$SYS_MAIL_CMD_QUEUE_COUNT" 2>/dev/null || echo "")
    print_info "$queue_summary"

    # Extract message count from summary line (last number is always message count)
@@ -131,7 +131,7 @@ elif [ "$MTA" = "sendmail" ]; then
        echo ""

        # Cache queue list - single execution for all operations
-        queue_list=$(eval "$SYS_MAIL_CMD_QUEUE_LIST")
+        queue_list=$(bash -c "$SYS_MAIL_CMD_QUEUE_LIST" 2>/dev/null || echo "")

        print_header "Queue Details (first 50)"
        echo "$queue_list" | head -50
@@ -1,4 +1,5 @@
 #!/bin/bash
+set -eo pipefail

 ################################################################################
 # Disk Space Analyzer (WinDirStat for Linux)
@@ -17,6 +18,7 @@
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 source "$SCRIPT_DIR/lib/common-functions.sh"
 source "$SCRIPT_DIR/lib/system-detect.sh"
+source "$SCRIPT_DIR/lib/reference-db.sh"

 # Require root
 if [ "$EUID" -ne 0 ]; then
@@ -24,6 +26,9 @@ if [ "$EUID" -ne 0 ]; then
    exit 1
 fi

+# Ensure cache is fresh (only rebuilds if > 1 hour old)
+db_ensure_fresh 2>/dev/null || true
+
 # Temp file for results
 TEMP_DIR="/tmp/disk-analysis-$$"
 mkdir -p "$TEMP_DIR"
@@ -619,55 +624,51 @@ analyze_wordpress() {
    print_banner "WordPress Storage Analysis"
    echo ""

-    # Find WordPress installations
+    # Find WordPress installations from cache (instant lookup, no filesystem scan)
    show_progress "Finding WordPress installations"

-    local wp_paths=()
+    local wp_count=0
+    local wp_data=""

-    # Common locations
-    if [ -d "/home" ]; then
-        while IFS= read -r wp_config; do
-            wp_dir=$(dirname "$wp_config")
-            wp_paths+=("$wp_dir")
-        done < <(find /home -name "wp-config.php" -type f 2>/dev/null)
+    # Get WordPress data from cache
+    if command -v db_get_all_wordpress &>/dev/null; then
+        wp_data=$(db_get_all_wordpress 2>/dev/null || true)
    fi

-    if [ -d "/var/www" ]; then
-        while IFS= read -r wp_config; do
-            wp_dir=$(dirname "$wp_config")
-            wp_paths+=("$wp_dir")
-        done < <(find /var/www -name "wp-config.php" -type f 2>/dev/null)
+    # Count WP installations
+    if [ -n "$wp_data" ]; then
+        wp_count=$(echo "$wp_data" | grep -c "^WP|" || echo 0)
    fi

-    if [ ${#wp_paths[@]} -eq 0 ]; then
+    if [ "$wp_count" -eq 0 ]; then
        echo -e "\r${DIM}No WordPress installations found${NC}                              "
        echo ""
        press_enter
        return
    fi

-    echo -e "\r${GREEN}✓${NC} Found ${#wp_paths[@]} WordPress installations                              "
+    echo -e "\r${GREEN}✓${NC} Found ${wp_count} WordPress installations                              "
    echo ""

    echo -e "${BOLD}WordPress Space Usage:${NC}"
    echo "───────────────────────────────────────────────────────────────"

-    for wp_dir in "${wp_paths[@]}"; do
-        # Get domain/user from path
-        domain=$(echo "$wp_dir" | awk -F'/' '{for(i=1;i<=NF;i++) if($i~/public_html|httpdocs|www/) print $(i-1)}' | tail -1)
+    # Process cached WordPress data
+    while IFS='|' read -r type domain path db_name db_user version plugins themes; do
+        if [ "$type" = "WP" ] && [ -d "$path" ]; then
+            # Calculate sizes
+            total_size=$(du -sh "$path" 2>/dev/null | awk '{print $1}')
+            uploads_size=$(du -sh "$path/wp-content/uploads" 2>/dev/null | awk '{print $1}')
+            plugins_size=$(du -sh "$path/wp-content/plugins" 2>/dev/null | awk '{print $1}')
+            cache_size=$(du -sh "$path/wp-content/cache" 2>/dev/null | awk '{print $1}')

-        # Calculate sizes
-        total_size=$(du -sh "$wp_dir" 2>/dev/null | awk '{print $1}')
-        uploads_size=$(du -sh "$wp_dir/wp-content/uploads" 2>/dev/null | awk '{print $1}')
-        plugins_size=$(du -sh "$wp_dir/wp-content/plugins" 2>/dev/null | awk '{print $1}')
-        cache_size=$(du -sh "$wp_dir/wp-content/cache" 2>/dev/null | awk '{print $1}')
-
-        echo -e "${BOLD}$domain${NC} ($total_size)"
-        echo -e "  Uploads: ${CYAN}${uploads_size:-0}${NC}"
-        echo -e "  Plugins: ${CYAN}${plugins_size:-0}${NC}"
-        echo -e "  Cache:   ${CYAN}${cache_size:-0}${NC}"
-        echo ""
-    done
+            echo -e "${BOLD}$domain${NC} ($total_size)"
+            echo -e "  Uploads: ${CYAN}${uploads_size:-0}${NC}"
+            echo -e "  Plugins: ${CYAN}${plugins_size:-0}${NC}"
+            echo -e "  Cache:   ${CYAN}${cache_size:-0}${NC}"
+            echo ""
+        fi
+    done <<< "$wp_data"

    echo -e "${BOLD}Cleanup Suggestions:${NC}"
    echo "  • Delete old revisions: wp post delete \$(wp post list --post_type=revision --format=ids)"
@@ -15,6 +15,9 @@ source "$TOOLKIT_ROOT/lib/reference-db.sh"
 # Initialize system detection
 detect_system

+# Ensure reference database is fresh (only rebuild if > 1 hour old)
+db_ensure_fresh 2>/dev/null || true
+
 # Load system info from reference database
 if [ -f "$TOOLKIT_ROOT/.sysref" ]; then
    SYS_HOSTNAME=$(grep "^SYS|HOSTNAME|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f3)
@@ -15,6 +15,9 @@ source "$TOOLKIT_ROOT/lib/reference-db.sh"
 # Initialize system detection
 detect_system

+# Ensure reference database is fresh (only rebuild if > 1 hour old)
+db_ensure_fresh 2>/dev/null || true
+
 # Load system info from reference database
 if [ -f "$TOOLKIT_ROOT/.sysref" ]; then
    SYS_HOSTNAME=$(grep "^SYS|HOSTNAME|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f3)
@@ -31,6 +31,9 @@ if [ "$EUID" -ne 0 ]; then
    exit 1
 fi

+# Ensure reference database is fresh (only rebuild if > 1 hour old)
+db_ensure_fresh 2>/dev/null || true
+
 # Configuration
 BACKUP_DIR="/root/nginx-varnish-backups"
 VARNISH_VCL="/etc/varnish/default.vcl"
@@ -149,11 +152,28 @@ create_backup() {
    echo "$backup_path"
 }

-# Get list of cPanel domains
+# Get list of cPanel domains (from launcher cache, not filesystem)
 get_cpanel_domains() {
+    # Use launcher's cached domain list (instant lookup, already filtered by launcher)
+    # Fallback to filesystem scan only if cache unavailable
+
+    if command -v db_get_all_domains &>/dev/null; then
+        # Use cached data from launcher (built on startup, instant O(n) lookup)
+        db_get_all_domains 2>/dev/null || {
+            # Fallback if cache fails (shouldn't happen if db_ensure_fresh was called)
+            get_cpanel_domains_fallback
+        }
+    else
+        # Library not available, use filesystem fallback
+        get_cpanel_domains_fallback
+    fi
+}
+
+# Fallback domain discovery (only used if cache unavailable)
+get_cpanel_domains_fallback() {
    local domains=()

-    # Get domains from cPanel user data
+    # Fallback: Get domains from cPanel user data
    if [ -d /var/cpanel/userdata ]; then
        while IFS= read -r domain_file; do
            local domain=$(basename "$domain_file")
@@ -683,9 +683,9 @@ save_baseline() {
            local baseline_file="$BASELINE_DIR/${domain}_baseline.txt"

            # Get domain-specific metrics
-            local domain_requests=$(grep "^[^|]*|$domain|" "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | wc -l || echo "0")
-            local domain_attacks=$(grep "^[^|]*|$domain|" "$TEMP_DIR/attack_vectors_raw.txt" 2>/dev/null | wc -l || echo "0")
-            local domain_bots=$(grep "^[^|]*|$domain|" "$TEMP_DIR/classified_bots.txt" 2>/dev/null | wc -l || echo "0")
+            local domain_requests=$(grep -F "|$domain|" "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | wc -l || echo "0")
+            local domain_attacks=$(grep -F "|$domain|" "$TEMP_DIR/attack_vectors_raw.txt" 2>/dev/null | wc -l || echo "0")
+            local domain_bots=$(grep -F "|$domain|" "$TEMP_DIR/classified_bots.txt" 2>/dev/null | wc -l || echo "0")

            # Append to baseline history (timestamp|requests|attacks|bots|high_risk_ips)
            echo "$today|$domain_requests|$domain_attacks|$domain_bots|$high_risk_ips" >> "$baseline_file"
@@ -747,7 +747,7 @@ analyze_attack_progression() {
        > "$progression_file"

        # Extract all requests from this IP, in order
-        grep "^$ip|" "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | awk -F'|' '{
+        grep -F "$ip|" "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | awk -F'|' '{
            print $8 "|" $3 "|" $4 "|" $6
        }' | sort >> "$progression_file"

@@ -1036,7 +1036,7 @@ detect_threats() {

        # Breakdown by attack type
        for attack_type in sqli xss path_traversal rce_upload info_disclosure login_bruteforce; do
-            grep "|$attack_type$" "$TEMP_DIR/attack_vectors_raw.txt" 2>/dev/null | \
+            grep -F "|$attack_type" "$TEMP_DIR/attack_vectors_raw.txt" 2>/dev/null | grep -F "|$attack_type$" | \
                awk -F'|' '{print $1"|"$2"|"$3"|"$4}' | \
                sort | uniq -c | sort -rn > "$TEMP_DIR/${attack_type}_attempts.txt" || true
        done
@@ -1311,7 +1311,7 @@ calculate_bot_fingerprint() {
        }
        close(tmpdir "/bot_fingerprints.txt")
    }
-    ' < "$TEMP_DIR/parsed_logs.txt"
+    ' < "$TEMP_DIR/parsed_logs.txt" 2>/dev/null || true

    # Create file if empty
    touch "$TEMP_DIR/bot_fingerprints.txt"
@@ -1626,13 +1626,13 @@ analyze_time_series() {
    print_info "Analyzing time-series patterns..."

    # Extract hourly bot traffic
-    cat "$TEMP_DIR/classified_bots.txt" 2>/dev/null | awk -F'|' '$9 != "unknown" {
+    awk -F'|' '$9 != "unknown" {
        timestamp = $8
        if (match(timestamp, /([0-9]{2})\/([A-Za-z]{3})\/([0-9]{4}):([0-9]{2}):([0-9]{2}):([0-9]{2})/, ts)) {
            hour = ts[4]
            print hour
        }
-    }' | sort | uniq -c > "$TEMP_DIR/hourly_bot_traffic.txt" || true
+    }' "$TEMP_DIR/classified_bots.txt" 2>/dev/null | sort | uniq -c > "$TEMP_DIR/hourly_bot_traffic.txt" || true

    # Extract hourly attack traffic
    if [ -f "$TEMP_DIR/attack_vectors_raw.txt" ]; then
@@ -1660,7 +1660,7 @@ calculate_threat_scores() {
    declare -A ip_request_counts
    while IFS='|' read -r ip rest; do
        ((ip_request_counts["$ip"]++))
-    done < <(cat "$TEMP_DIR/parsed_logs.txt")
+    done < "$TEMP_DIR/parsed_logs.txt"

    # Build hash tables from threat files for O(1) lookups
    # OPTIMIZATION: Use awk instead of echo|awk|cut in loops (10x faster)
@@ -1912,7 +1912,7 @@ detect_false_positives() {
    print_info "Detecting legitimate services (false positives)..."

    # Known monitoring service patterns and legitimate CDNs
-    cat "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | awk -F'|' '{
+    awk -F'|' '{
        ip = $1
        domain = $2
        url = $3
@@ -1952,7 +1952,7 @@ detect_false_positives() {
        else if (match(url, /checkout|payment|paypal|stripe|square/) && match(ua, /paypal|stripe|square/)) {
            print ip "|Payment Processor|" ua "|" domain
        }
-    }' | sort -u > "$TEMP_DIR/false_positives.txt" || true
+    }' "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | sort -u > "$TEMP_DIR/false_positives.txt" || true

    print_success "False positive detection complete ($(wc -l < "$TEMP_DIR/false_positives.txt" 2>/dev/null || echo 0) legitimate services identified)"
 }
@@ -1966,7 +1966,7 @@ generate_statistics() {

    # OPTIMIZATION: Use single-pass AWK to generate multiple stats from parsed logs
    # This reads the uncompressed file ONCE instead of 4+ separate reads
-    cat "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | awk -F'|' -v tmpdir="$TEMP_DIR" '
+    awk -F'|' -v tmpdir="$TEMP_DIR" '
    {
        # Count by domain (for top sites)
        domains[$2]++
@@ -1995,29 +1995,29 @@ generate_statistics() {
        close(tmpdir "/top_sites_raw.txt")
        close(tmpdir "/top_ips_raw.txt")
        close(tmpdir "/top_urls_raw.txt")
-    }'
+    }' "$TEMP_DIR/parsed_logs.txt" 2>/dev/null

-    # Sort and limit results
-    sort -rn "$TEMP_DIR/top_sites_raw.txt" | head -5 > "$TEMP_DIR/top_sites.txt"
-    sort -rn "$TEMP_DIR/top_ips_raw.txt" | head -5 > "$TEMP_DIR/top_ips.txt"
-    sort -rn "$TEMP_DIR/top_urls_raw.txt" | head -5 > "$TEMP_DIR/top_urls.txt"
+    # Sort and limit results (files may not exist if no data)
+    [ -f "$TEMP_DIR/top_sites_raw.txt" ] && sort -rn "$TEMP_DIR/top_sites_raw.txt" | head -5 > "$TEMP_DIR/top_sites.txt" || touch "$TEMP_DIR/top_sites.txt"
+    [ -f "$TEMP_DIR/top_ips_raw.txt" ] && sort -rn "$TEMP_DIR/top_ips_raw.txt" | head -5 > "$TEMP_DIR/top_ips.txt" || touch "$TEMP_DIR/top_ips.txt"
+    [ -f "$TEMP_DIR/top_urls_raw.txt" ] && sort -rn "$TEMP_DIR/top_urls_raw.txt" | head -5 > "$TEMP_DIR/top_urls.txt" || touch "$TEMP_DIR/top_urls.txt"

    # Top 5 bots by request count (single decompression)
-    cat "$TEMP_DIR/classified_bots.txt" 2>/dev/null | awk -F'|' '$9 != "unknown" {print $10}' | \
+    awk -F'|' '$9 != "unknown" {print $10}' "$TEMP_DIR/classified_bots.txt" 2>/dev/null | \
        sort | uniq -c | sort -rn | head -5 > "$TEMP_DIR/top_bots.txt" || true

    # Traffic breakdown by bot type (single decompression)
-    cat "$TEMP_DIR/classified_bots.txt" 2>/dev/null | awk -F'|' '{print $9}' | \
+    awk -F'|' '{print $9}' "$TEMP_DIR/classified_bots.txt" 2>/dev/null | \
        sort | uniq -c | sort -rn > "$TEMP_DIR/traffic_breakdown.txt" || true

    # Per-domain traffic sources (OPTIMIZED: read uncompressed file once, use grep)
    if [ -f "$TEMP_DIR/all_domains.txt" ]; then
        # Create indexed bot traffic file (decompress once)
-        cat "$TEMP_DIR/classified_bots.txt" 2>/dev/null | awk -F'|' '{print $2"|"$9}' > "$TEMP_DIR/domain_bot_types.txt" || true
+        awk -F'|' '{print $2"|"$9}' "$TEMP_DIR/classified_bots.txt" 2>/dev/null > "$TEMP_DIR/domain_bot_types.txt" || true

        while read -r domain; do
            echo "$domain" > "$TEMP_DIR/domain_${domain}_stats.txt"
-            grep "^$domain|" "$TEMP_DIR/domain_bot_types.txt" 2>/dev/null | cut -d'|' -f2 | \
+            grep -F "$domain|" "$TEMP_DIR/domain_bot_types.txt" 2>/dev/null | cut -d'|' -f2 | \
                sort | uniq -c | sort -rn >> "$TEMP_DIR/domain_${domain}_stats.txt" || true
        done < "$TEMP_DIR/all_domains.txt"
    fi
@@ -2070,7 +2070,7 @@ generate_comparison_report() {
            echo "   Baseline (7-day avg): $baseline_requests requests"
            echo "   Today: $total_requests requests"
        elif [ "$request_pct" -lt 50 ]; then
-            echo "🟢 LOW: Requests are $(($((100 - $request_pct))))% below baseline"
+            echo "🟢 LOW: Requests are $((100 - $request_pct))% below baseline"
        else
            echo "🟡 NORMAL: Requests within expected range"
        fi
@@ -2287,19 +2287,19 @@ generate_report() {
    # QUICK STATS DASHBOARD
    print_header "QUICK STATS DASHBOARD"

-    total_requests=$(wc -l < "$TEMP_DIR/parsed_logs.txt")
-    unique_ips=$(awk -F'|' '{print $1}' < "$TEMP_DIR/parsed_logs.txt" | sort -u | wc -l)
-    unique_domains=$(awk -F'|' '{print $2}' < "$TEMP_DIR/parsed_logs.txt" | sort -u | wc -l)
-    bot_requests=$(awk -F'|' '$9 != "unknown"' < "$TEMP_DIR/classified_bots.txt" | wc -l)
+    total_requests=$(wc -l < "$TEMP_DIR/parsed_logs.txt" 2>/dev/null || echo "0")
+    unique_ips=$(awk -F'|' '{print $1}' < "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | sort -u | wc -l || echo "0")
+    unique_domains=$(awk -F'|' '{print $2}' < "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | sort -u | wc -l || echo "0")
+    bot_requests=$(awk -F'|' '$9 != "unknown"' < "$TEMP_DIR/classified_bots.txt" 2>/dev/null | wc -l || echo "0")

    # Count private/internal IPs (excluded from threat analysis)
-    private_ips=$(awk -F'|' '{print $1}' < "$TEMP_DIR/parsed_logs.txt" | sort -u | grep -E '^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.)' || true | wc -l)
+    private_ips=$(awk -F'|' '{print $1}' < "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | sort -u | grep -E '^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.)' 2>/dev/null | wc -l || echo "0")

    # Count server's own IPs in the logs
    server_ip_hits=0
    if [ -f "$TEMP_DIR/server_ips.txt" ] && [ -s "$TEMP_DIR/server_ips.txt" ]; then
        while read -r server_ip; do
-            if cat "$TEMP_DIR/parsed_logs.txt" | grep -q "^$server_ip|" 2>/dev/null; then
+            if grep -q "^$server_ip|" "$TEMP_DIR/parsed_logs.txt" 2>/dev/null; then
                server_ip_hits=$((server_ip_hits + 1))
            fi
        done < "$TEMP_DIR/server_ips.txt"
@@ -2333,9 +2333,9 @@ generate_report() {
    # Traffic breakdown
    echo "Traffic Breakdown:"
    while read -r line; do
-        count=$(echo "$line" | awk '{print $1}')
-        type=$(echo "$line" | awk '{print $2}')
-        pct=$(awk "BEGIN {printf \"%.1f\", ($count/$total_requests)*100}")
+        count=$(echo "$line" | awk '{print $1}' || echo "0")
+        type=$(echo "$line" | awk '{print $2}' || echo "unknown")
+        pct=$(awk "BEGIN {printf \"%.1f\", (${count:-0}/${total_requests:-1})*100}" 2>/dev/null || echo "0.0")
        
        case $type in
            legit) echo "  Legitimate Bots:    $(printf "%'7d" $count) ($pct%)" ;;
@@ -2352,6 +2352,7 @@ generate_report() {
        echo ""
        echo "Bot Traffic Timeline (hourly):"
        max_bot_traffic=$(awk '{print $1}' "$TEMP_DIR/hourly_bot_traffic.txt" | sort -rn | head -1)
+        max_bot_traffic=${max_bot_traffic:-1}  # Prevent division by zero
        while read -r line; do
            count=$(echo "$line" | awk '{print $1}')
            hour=$(echo "$line" | awk '{print $2}')
@@ -2378,9 +2379,9 @@ generate_report() {
        echo ""
        echo "Response Code Analysis:"
        while read -r line; do
-            count=$(echo "$line" | awk '{print $1}')
-            code=$(echo "$line" | awk '{print $2}')
-            pct=$(awk "BEGIN {printf \"%.1f\", ($count/$total_requests)*100}")
+            count=$(echo "$line" | awk '{print $1}' || echo "0")
+            code=$(echo "$line" | awk '{print $2}' || echo "000")
+            pct=$(awk "BEGIN {printf \"%.1f\", (${count:-0}/${total_requests:-1})*100}" 2>/dev/null || echo "0.0")

            case $code in
                200) echo "  200 (Success):     $(printf "%'7d" $count) ($pct%) Bots are getting data" ;;
@@ -2453,7 +2454,7 @@ generate_report() {

        # Show top attacked domains with attack details
        awk -F'|' 'NR <= 10 {print $1}' "$TEMP_DIR/domain_targeting.txt" | while read -r domain; do
-            domain_attack_count=$(grep "^[^|]*|${domain}|" "$TEMP_DIR/attack_vectors_raw.txt" 2>/dev/null | wc -l || echo "0")
+            domain_attack_count=$(grep -F "|${domain}|" "$TEMP_DIR/attack_vectors_raw.txt" 2>/dev/null | wc -l || echo "0")

            if [ "$domain_attack_count" -gt 0 ]; then
                echo "  Domain: $domain ($domain_attack_count attack attempts)"
@@ -2633,7 +2634,7 @@ generate_report() {
        # Calculate total bot bandwidth
        total_bot_bandwidth=0
        if [ -f "$TEMP_DIR/classified_bots.txt.gz" ]; then
-            total_bot_bandwidth=$(cat "$TEMP_DIR/classified_bots.txt" | awk -F'|' '$9 != "unknown" && $5 ~ /^[0-9]+$/ {sum += $5} END {print sum}')
+            total_bot_bandwidth=$(awk -F'|' '$9 != "unknown" && $5 ~ /^[0-9]+$/ {sum += $5} END {print sum}' "$TEMP_DIR/classified_bots.txt")
        fi

        if [ -n "$total_bot_bandwidth" ] && [ "$total_bot_bandwidth" -gt 0 ]; then
@@ -2642,7 +2643,7 @@ generate_report() {
            # Estimate cost at $0.09/GB (typical CDN pricing)
            estimated_cost=$(awk "BEGIN {printf \"%.2f\", ($total_bot_bandwidth/1073741824) * 0.09}")

-            total_bandwidth=$(cat "$TEMP_DIR/parsed_logs.txt" | awk -F'|' '$5 ~ /^[0-9]+$/ {sum += $5} END {print sum}')
+            total_bandwidth=$(awk -F'|' '$5 ~ /^[0-9]+$/ {sum += $5} END {print sum}' "$TEMP_DIR/parsed_logs.txt")
            bot_pct=$(awk "BEGIN {printf \"%.1f\", ($total_bot_bandwidth/$total_bandwidth)*100}")

            echo ""
@@ -2654,13 +2655,13 @@ generate_report() {
        echo "   Top bandwidth consumers:"

        head -3 "$TEMP_DIR/large_transfers.txt" | while read -r line; do
-            count=$(echo "$line" | awk '{print $1}')
-            ip=$(echo "$line" | awk '{print $2}' | cut -d'|' -f1)
-            domain=$(echo "$line" | awk '{print $2}' | cut -d'|' -f2)
-            url=$(echo "$line" | awk '{print $2}' | cut -d'|' -f3)
-            size=$(echo "$line" | awk '{print $2}' | cut -d'|' -f4)
-            size_mb=$(awk "BEGIN {printf \"%.1f\", $size/1048576}")
-            total_ip_mb=$(awk "BEGIN {printf \"%.0f\", $size * $count / 1048576}")
+            count=$(echo "$line" | awk '{print $1}' || echo "0")
+            ip=$(echo "$line" | awk '{print $2}' 2>/dev/null | cut -d'|' -f1 || echo "unknown")
+            domain=$(echo "$line" | awk '{print $2}' 2>/dev/null | cut -d'|' -f2 || echo "unknown")
+            url=$(echo "$line" | awk '{print $2}' 2>/dev/null | cut -d'|' -f3 || echo "unknown")
+            size=$(echo "$line" | awk '{print $2}' 2>/dev/null | cut -d'|' -f4 || echo "0")
+            size_mb=$(awk "BEGIN {printf \"%.1f\", ${size:-0}/1048576}" 2>/dev/null || echo "0.0")
+            total_ip_mb=$(awk "BEGIN {printf \"%.0f\", ${size:-0} * ${count:-0} / 1048576}" 2>/dev/null || echo "0")
            printf "      %s transfers from %s - %.1f MB avg (%s MB total) - %s%s\n" "$count" "$ip" "$size_mb" "$total_ip_mb" "$domain" "$url"
        done
        echo "      Action: Verify if scraping, consider serving WebP/optimized images"
@@ -2673,17 +2674,17 @@ generate_report() {

    counter=1
    while read -r line && [ "${counter:-0}" -le 5 ]; do
-        count=$(echo "$line" | awk '{print $1}')
-        domain=$(echo "$line" | awk '{print $2}')
-        
+        count=$(echo "$line" | awk '{print $1}' || echo "0")
+        domain=$(echo "$line" | awk '{print $2}' || echo "unknown")
+
        echo "[$counter] $domain - $count requests"
-        
+
        # Show traffic breakdown for this domain
        if [ -f "$TEMP_DIR/domain_${domain}_stats.txt" ]; then
            tail -n +2 "$TEMP_DIR/domain_${domain}_stats.txt" | while read -r stat_line; do
-                stat_count=$(echo "$stat_line" | awk '{print $1}')
-                stat_type=$(echo "$stat_line" | awk '{print $2}')
-                pct=$(awk "BEGIN {printf \"%.1f\", ($stat_count/$count)*100}")
+                stat_count=$(echo "$stat_line" | awk '{print $1}' || echo "0")
+                stat_type=$(echo "$stat_line" | awk '{print $2}' || echo "unknown")
+                pct=$(awk "BEGIN {printf \"%.1f\", (${stat_count:-0}/${count:-1})*100}" 2>/dev/null || echo "0.0")
                
                case $stat_type in
                    suspicious) echo -e "      ${YELLOW}Suspicious: $stat_count ($pct%)${NC}" ;;
@@ -3364,15 +3365,15 @@ generate_recommendations() {
        attack_scope="single_domain"
        primary_target=$(head -1 "$TEMP_DIR/domain_high_risk_ips.txt" 2>/dev/null | cut -d'|' -f1)
        # Calculate what % of high-risk IPs are targeting this domain
-        local domain_risk_count=$(head -1 "$TEMP_DIR/domain_high_risk_ips.txt" 2>/dev/null | cut -d'|' -f2)
-        if [ "${total_high_risk_ips:-0}" -gt 0 ]; then
-            primary_target_percentage=$(awk "BEGIN {printf \"%.0f\", ($domain_risk_count / $total_high_risk_ips) * 100}")
+        local domain_risk_count=$(head -1 "$TEMP_DIR/domain_high_risk_ips.txt" 2>/dev/null | cut -d'|' -f2 || echo "0")
+        if [ "${total_high_risk_ips:-0}" -gt 0 ] && [ "${domain_risk_count:-0}" -gt 0 ]; then
+            primary_target_percentage=$(awk "BEGIN {printf \"%.0f\", (${domain_risk_count:-0} / ${total_high_risk_ips:-0}) * 100}")
        fi
    elif [ "${affected_domains:-0}" -gt 1 ] && [ "${total_domains:-0}" -gt 1 ]; then
        # Check if one domain is getting most of the traffic
-        local top_domain_count=$(head -1 "$TEMP_DIR/domain_threats_sorted.txt" 2>/dev/null | cut -d'|' -f5)
+        local top_domain_count=$(head -1 "$TEMP_DIR/domain_threats_sorted.txt" 2>/dev/null | cut -d'|' -f5 || echo "0")
        if [ "${top_domain_count:-0}" -gt 0 ] && [ "${total_high_risk_ips:-0}" -gt 0 ]; then
-            local top_percentage=$(awk "BEGIN {printf \"%.0f\", ($top_domain_count / $total_high_risk_ips) * 100}")
+            local top_percentage=$(awk "BEGIN {printf \"%.0f\", (${top_domain_count:-0} / ${total_high_risk_ips:-0}) * 100}")
            if [ "$top_percentage" -ge 75 ]; then
                attack_scope="primary_target"
                primary_target=$(head -1 "$TEMP_DIR/domain_threats_sorted.txt" 2>/dev/null | cut -d'|' -f1)
@@ -3675,7 +3676,7 @@ show_detailed_recommendations() {
                local target_domain=$(echo "$action_title" | grep -oP 'to \K[^ ]+' 2>/dev/null || echo "")
                echo "Target Domain: $target_domain"
                if [ -s "$TEMP_DIR/domain_threats_sorted.txt" ]; then
-                    grep "^$target_domain|" "$TEMP_DIR/domain_threats_sorted.txt" 2>/dev/null | while IFS='|' read -r domain total_req bot_req bot_pct high_risk attacks ips; do
+                    grep -F "$target_domain|" "$TEMP_DIR/domain_threats_sorted.txt" 2>/dev/null | while IFS='|' read -r domain total_req bot_req bot_pct high_risk attacks ips; do
                        echo "  • Total Requests: $total_req"
                        echo "  • Bot Requests: $bot_req ($bot_pct%)"
                        echo "  • High-Risk IPs: $high_risk"
@@ -4003,7 +4004,7 @@ execute_ip_blocking_specific() {
    local fail_count=0

    for ip in "${ips_to_block[@]}"; do
-        local score=$(grep "|$ip|" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "unknown")
+        local score=$(grep -F "|$ip|" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "unknown")

        if csf -td "$ip" "$duration" "Bot threat score: $score/100 - Auto-blocked by toolkit" >/dev/null 2>&1; then
            echo -e "  ${GREEN}${NC} Blocked $ip for $duration_text (score: $score/100)"
@@ -4153,7 +4154,7 @@ execute_htaccess_domain_blocking() {
    # Find document root for this domain using reference database
    local doc_root=""
    if [ -s "$SCRIPT_DIR/.sysref" ]; then
-        doc_root=$(grep "^DOMAIN|$target_domain|" "$SCRIPT_DIR/.sysref" 2>/dev/null | head -1 | cut -d'|' -f4 || echo "")
+        doc_root=$(grep -F "DOMAIN|$target_domain|" "$SCRIPT_DIR/.sysref" 2>/dev/null | head -1 | cut -d'|' -f4 || echo "")
    fi

    if [ -z "$doc_root" ]; then
@@ -4197,10 +4198,10 @@ execute_htaccess_domain_blocking() {
    print_info "Adding bot blocking rules..."

    # Get high-risk IPs for this domain
-    local block_ips=$(cat "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | grep "^[^|]*|$target_domain|" 2>/dev/null || true | cut -d'|' -f1 | sort -u | while read ip; do
+    local block_ips=$(cat "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | grep -F "|$target_domain|" 2>/dev/null || true | cut -d'|' -f1 | sort -u | while read ip; do
        # Check if this IP has high threat score
-        if grep -q "|$ip$" "$TEMP_DIR/threat_scores.txt" 2>/dev/null; then
-            local score=$(grep "|$ip$" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "0")
+        if grep -q -F "|$ip|" "$TEMP_DIR/threat_scores.txt" 2>/dev/null; then
+            local score=$(grep -F "|$ip|" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "0")
            if [ "${score:-0}" -ge 70 ]; then
                echo "$ip"
            fi
@@ -4520,7 +4521,7 @@ offer_csf_blocking() {
        count=$((count + 1))
        local ip="${high_risk_ips[$i]}"
        local score="${ip_scores[$i]}"
-        local requests=$(grep "^$ip|" "$TEMP_DIR/bot_ips.txt" 2>/dev/null | cut -d'|' -f2 || echo "0")
+        local requests=$(grep -F "$ip|" "$TEMP_DIR/bot_ips.txt" 2>/dev/null | cut -d'|' -f2 || echo "0")

        # Color code by severity
        if [ "$score" -ge 90 ]; then
@@ -4586,7 +4587,7 @@ apply_csf_blocks() {

    for ip in "${ips[@]}"; do
        # Get threat score for comment
-        local score=$(grep "|$ip$" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "unknown")
+        local score=$(grep -F "|$ip|" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "unknown")

        # Use csf -td for temporary deny
        if csf -td "$ip" "$duration" "Bot threat score: $score/100 - Auto-blocked by toolkit" >/dev/null 2>&1; then
@@ -4639,7 +4640,7 @@ apply_csf_permanent_blocks() {
    local fail_count=0

    for ip in "${ips[@]}"; do
-        local score=$(grep "|$ip$" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "unknown")
+        local score=$(grep -F "|$ip|" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "unknown")

        # Use csf -d for permanent deny
        if csf -d "$ip" "Bot threat score: $score/100 - Permanently blocked by toolkit" >/dev/null 2>&1; then
@@ -2156,7 +2156,7 @@ for scanner in "${available_scanners[@]}"; do
            # Extract scan results from event log (more reliable than parsing output)
            # Maldet logs to /usr/local/maldetect/logs/event_log
            # Use dynamic path search for portability across all platforms (FIXED Issue 2: comprehensive path discovery)
-            local event_log=""
+            event_log=""

            # Search standard locations in order of likelihood
            for search_path in \
@@ -2556,7 +2556,7 @@ STANDALONE_EOF
    fi

    # Inject MALDET_ONLY flag for Maldet-dedicated scans
-    local maldet_flag="${MALDET_ONLY:-0}"
+    maldet_flag="${MALDET_ONLY:-0}"
    if ! sed -i "s|PLACEHOLDER_MALDET_ONLY|$maldet_flag|" "$session_dir/scan.sh"; then
        echo -e "${RED}ERROR: Failed to inject MALDET_ONLY flag${NC}"
        return 1
@@ -826,11 +826,8 @@ main() {
        echo ""
    fi

-    # Check if sysref database exists, build if needed
-    if [ ! -f "$SYSREF_DB" ] || [ ! -s "$SYSREF_DB" ]; then
-        print_status "Building system reference database (first run)..."
-        build_reference_database >/dev/null 2>&1
-    fi
+    # Ensure reference database is fresh (only rebuild if > 1 hour old)
+    db_ensure_fresh >/dev/null 2>&1

    # Run analysis
    check_server_resources
@@ -1,4 +1,5 @@
 #!/bin/bash
+set -eo pipefail

 #
 # Suspicious Login Monitor - Integrated Security Analysis & Compromise Detection
@@ -11,6 +12,9 @@
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TOOLKIT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"

+# Source reference-db for cache support (avoid redundant /etc/passwd parsing)
+source "$TOOLKIT_ROOT/lib/reference-db.sh" 2>/dev/null || true
+
 # Configuration
 SUSPICIOUS_LOGIN_AUTO_BLOCK="${SUSPICIOUS_LOGIN_AUTO_BLOCK:-yes}"
 SUSPICIOUS_LOGIN_AUTO_SCAN="${SUSPICIOUS_LOGIN_AUTO_SCAN:-yes}"
@@ -1673,7 +1677,7 @@ check_maintenance_mode() {
    fi

    if [ -n "$indicators" ]; then
-        echo "maintenance-mode:$(echo $indicators | sed 's/ $//')"
+        echo "maintenance-mode:$(sed 's/ $//' <<< "$indicators")"
        return 0
    fi

@@ -1823,6 +1827,10 @@ check_recent_password_changes() {
    fi

    # Check for locked accounts that were recently unlocked
+    # OPTIMIZATION: Read /etc/passwd ONCE, build nologin list, then check against it
+    # (avoiding redundant grep for each user in the loop)
+    local nologin_users=$(awk -F: '/\/sbin\/nologin|\/bin\/false/ {print $1}' /etc/passwd 2>/dev/null | tr '\n' '|')
+
    local recently_unlocked=$(awk -F: -v cutoff=$(( $(date +%s) / 86400 - 7 )) '
        # Field 2 starts with ! or !! = locked
        # If field 3 (last change) is recent and field 2 does NOT start with !, might have been unlocked
@@ -1830,8 +1838,8 @@ check_recent_password_changes() {
            print $1
        }
    ' /etc/shadow 2>/dev/null | while read user; do
-        # Check if account was previously locked (this is imperfect without history)
-        if grep "^$user:" /etc/passwd | grep -q "/sbin/nologin\|/bin/false"; then
+        # Check if account has nologin shell (from pre-built list)
+        if [[ "|$nologin_users" =~ \|$user\| ]]; then
            echo "$user"
        fi
    done)
@@ -2947,6 +2955,11 @@ main() {
    echo -e "${CYAN}Starting Suspicious Login Monitor...${NC}"
    echo ""

+    # Ensure cache is fresh (only rebuilds if > 1 hour old)
+    if command -v db_ensure_fresh &>/dev/null; then
+        db_ensure_fresh 2>/dev/null || true
+    fi
+
    # Detect panel
    local panel=$(detect_panel)
    echo "Detected panel: $panel"
@@ -1977,18 +1977,18 @@ calculate_performance_score() {

    # Calculate score (100 - issues)
    local score=$((100 - (critical_count * 10) - (warning_count * 2)))
-    [ $score -lt 0 ] && score=0
-    [ $score -gt 100 ] && score=100
+    [ "$score" -lt 0 ] && score=0
+    [ "$score" -gt 100 ] && score=100

    # Determine grade
    local grade
-    if [ $score -ge 90 ]; then
+    if [ "$score" -ge 90 ]; then
        grade="A - EXCELLENT"
-    elif [ $score -ge 80 ]; then
+    elif [ "$score" -ge 80 ]; then
        grade="B - GOOD"
-    elif [ $score -ge 70 ]; then
+    elif [ "$score" -ge 70 ]; then
        grade="C - FAIR"
-    elif [ $score -ge 60 ]; then
+    elif [ "$score" -ge 60 ]; then
        grade="D - POOR"
    else
        grade="F - CRITICAL"
@@ -10,14 +10,22 @@ set -o pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CLEANUP_FLAG="/tmp/.cleanup_requested"

-# Save original history setting to restore even if interrupted
-HISTORY_SETTING=$(set +o | grep history)
+# Save original history state to restore even if interrupted
+HISTORY_STATE="off"
+if set -o | grep -q "^set +o history" 2>/dev/null; then
+    HISTORY_STATE="on"
+fi
 RESTORE_HISTORY=false

 # Cleanup function: restore history even on error/interrupt
 cleanup_on_exit() {
-    if [ "$RESTORE_HISTORY" = true ]; then
-        eval "$HISTORY_SETTING" 2>/dev/null || true
+    if [ "$RESTORE_HISTORY" = true ] && [ -n "$HISTORY_STATE" ]; then
+        set +H  # Disable history expansion temporarily
+        if [ "$HISTORY_STATE" = "on" ]; then
+            set -o history
+        else
+            set +o history
+        fi
    fi
 }

@@ -59,7 +67,11 @@ source "$SCRIPT_DIR/launcher.sh"
 LAUNCHER_EXIT=$?

 # Re-enable history (trap will also do this)
-eval "$HISTORY_SETTING" 2>/dev/null || true
+if [ "$HISTORY_STATE" = "on" ]; then
+    set -o history 2>/dev/null || true
+else
+    set +o history 2>/dev/null || true
+fi
 RESTORE_HISTORY=false

 # Handle cleanup request (if user selected "Clean and remove traces")
Author	SHA1	Message	Date
Developer	cf362c2adf	Fix: Add guard to prevent division by zero at line 2359 The max_bot_traffic variable is extracted from a file which could theoretically contain all zeros, causing division by zero. Added: max_bot_traffic=${max_bot_traffic:-1} This ensures the denominator is never zero while preserving the intended logic when valid data exists.	2026-04-23 21:27:06 -04:00
Developer	9471355e77	Fix: Remove UUOC (Useless Use Of Cat) patterns throughout script Replaced 'cat file \| awk' with 'awk file' patterns for efficiency. This eliminates unnecessary child processes and improves performance. Changes: - Lines 1629-1635: hourly bot traffic analysis - Lines 1915-1955: false positive detection (awk single script) - Lines 1969-1998: statistics generation (added file argument) - Lines 2006-2007: top bots calculation - Lines 2010-2011: traffic breakdown calculation - Line 2016: domain bot types indexing - Lines 2636, 2645: bandwidth impact calculation These are all simple pipe-to-awk patterns that can be inverted to pass the file directly to awk instead of piping from cat.	2026-04-23 21:26:37 -04:00
Developer	d159dd28d8	Fix: Convert all grep patterns to use -F flag (fixed-string matching) to prevent regex injection This prevents domain names, IPs, and other variables with special characters (like dots in domains) from being interpreted as regex wildcards. Changed patterns from: grep "pattern_with_$var" to: grep -F "pattern_with_$var" Affects 11 grep statements across multiple functions: - Domain-specific metrics calculation (lines 686-688) - IP progression analysis (line 750) - Attack type breakdown (line 1039) - Domain bot type indexing (line 2020) - Domain threat statistics (line 3678) - High-risk IP blocking (lines 4006, 4156, 4200, 4202-4203) - High-risk IP listing (line 4523) - Temporary deny blocking (lines 4589, 4642) This hardens the script against regex injection attacks and ensures correct literal string matching regardless of special characters in data.	2026-04-23 21:24:47 -04:00
Developer	01b63c6ad4	CRITICAL: Add guards to all unquoted AWK arithmetic expressions Multiple locations had unquoted bash variables in AWK BEGIN blocks that could fail if variables were empty or malformed: - Lines 3369, 3375: Added fallbacks to domain/traffic counts - Lines 2338, 2383: Added error handling to percentage calculations - Lines 2657-2663: Added guards to bandwidth calculations - Line 2686: Added guards to domain traffic breakdown calculations All AWK arithmetic now uses ${var:-0} defaults and 2>/dev/null error suppression to prevent syntax errors from empty values.	2026-04-23 21:20:33 -04:00
Developer	63e6cf067e	CRITICAL: Add error handling to stats dashboard calculations - Line 2290: Added 2>/dev/null fallback to wc for total_requests - Line 2291: Added 2>/dev/null fallback to unique_ips calculation - Line 2292: Added 2>/dev/null fallback to unique_domains calculation - Line 2293: Added 2>/dev/null fallback to bot_requests calculation - Line 2296: Improved error handling for private_ips calculation - Line 2302: Fixed UUOC (cat \| grep) pattern - removed useless cat These operations lack proper error handling and would crash with set -e if files are missing or malformed. Also removed inefficient cat pipe.	2026-04-23 21:19:37 -04:00
Developer	ca7ec62e02	Fix: Double arithmetic syntax error in generate_comparison_report (line 2073)	2026-04-23 21:16:33 -04:00