update and other bug fixes check changelog

docs/Exploit-Modules-Guide.md

@@ -27,6 +27,91 @@ if response.status() == 200 && body.contains("expected_indicator") {
 
 ---
 
+## Error Handling — no `.unwrap()`, no swallowing
+
+Modules must surface transport and decode failures explicitly. The framework
+treats a panicking module as a hard build/runtime failure, and silently
+swallowing a failed `send()` or `text()` causes both `check()` and `run()`
+to lie about what happened on the wire.
+
+**Forbidden patterns:**
+
+```rust
+// .unwrap() / .expect() — panic on error.
+let resp = client.get(&url).send().await.unwrap();
+
+// .unwrap_or_default() on Result-returning HTTP calls — turns transport
+// or decode failure into an empty body the caller assumes is the real one.
+let body = resp.text().await.unwrap_or_default();
+
+// `if let Ok(r) = ...` without an `else` arm — drops the network error
+// and silently falls through to "NotVulnerable" / "not detected".
+if let Ok(r) = client.get(&url).send().await {
+    /* … */
+}
+```
+
+**Preferred patterns:**
+
+In `check(...) -> CheckResult`, return `CheckResult::Error(…)` for failures so
+operators can distinguish "couldn't reach the host" from "host is patched":
+
+```rust
+match client.get(&url).send().await {
+    Ok(r) => match r.text().await {
+        Ok(body) if body.contains("foo") =>
+            CheckResult::Vulnerable("foo detected".into()),
+        Ok(_) => CheckResult::NotVulnerable("foo not present".into()),
+        Err(e) => CheckResult::Error(format!("body decode: {}", e)),
+    },
+    Err(e) => CheckResult::Error(format!("request failed: {}", e)),
+}
+```
+
+In `run(...) -> anyhow::Result<()>`, prefer `?` with `anyhow::Context` for
+abort-the-flow failures, and use `match` with `crate::mprintln!` when the
+loop should report-and-continue:
+
+```rust
+use anyhow::Context;
+
+let resp = client.get(&url).send().await.context("probe failed")?;
+let body = resp.text().await.context("read body")?;
+
+for path in candidate_paths {
+    match client.get(format!("{}{}", base, path)).send().await {
+        Ok(r) => { /* inspect r */ }
+        Err(e) => crate::mprintln!("{} {}: {}", "[-]".red(), path, e),
+    }
+}
+```
+
+**Helpers available** (all in `src/utils/network.rs`, re-exported as `crate::utils::*`):
+
+- `http_get_status_body(&client, &url) -> anyhow::Result<(u16, String)>` — single call that surfaces both transport and body-decode failures via `anyhow::Context`. Use it in `run()` with `let (_, body) = ... .await?;`. Use it in `check()` with `match`.
+- `http_get_status_headers_body(&client, &url) -> anyhow::Result<(u16, HeaderMap, String)>` — same but also returns the response headers, for fingerprints that look at `Server` / `Via` / `X-Powered-By`.
+- `header_string(headers, "name") -> String` — reads a header as `String`. Returns `""` if absent and the literal sentinel `"<non-utf8>"` if present-but-non-utf8, so the swallow that `.to_str().ok().unwrap_or("")` does silently is now visible in module output. Avoid the older `.to_str().ok().unwrap_or("")` chain — it hides the non-utf8 case.
+
+**The full list of banned patterns lives in [`BAD_PATTERNS.md`](BAD_PATTERNS.md)** — 91 regex patterns covering panicking error handling, silent error swallowing, lint suppression, panic vectors, lossy numeric casts, async/blocking pitfalls, logging discipline, HTTP-client policy, iterator glitches, style and embedded secrets. The doc ships with a copy-paste reproducer that returns a non-zero exit on any hit. Quick-reference banned highlights:
+
+- `.unwrap()`, `.expect("…")`, `.unwrap_or_default()`, `.unwrap_or(…)`, `.unwrap_or_else(…)`, `.to_str().ok().unwrap_or(…)`
+- `#[allow(dead_code)]`, `#[allow(unused_imports)]`, `#[allow(unused_variables)]`, any other `#[allow(...)]`
+- `panic!()`, `unreachable!()`, `todo!()`, `unimplemented!()`, `assert!`, `assert_eq!`
+- `if let Ok(_) = ...` without an `else` (silent fall-through) — use `match`
+- `Err(_) => …` anonymous binding even when the arm has a side effect. Always bind the value and surface it via `Display` — e.g. `Err(elapsed) => anyhow::bail!("connect to {} timed out after {:?}: {}", addr, CONNECT_TIMEOUT, elapsed)`
+- `let _ = <expression>;` where the expression returns `Result` — use `if let Err(e) = ...` and log `e`
+- Direct array index `arr[i]` and slice range `&buf[..n]` — use `arr.get(i)` / `buf.get(..n).context(...)?`
+- Lossy numeric casts (`as u16`, `as u64`, etc.) — use `try_into().with_context(...)?`
+- Sync I/O in async functions (`std::fs::*`, `std::process::Command`, `std::thread::sleep`, `std::net::TcpStream`) — use `tokio::*`
+
+**Native libraries (`crate::native::*`):** prefer in-tree helpers over third-party crates / hand-rolled formatting:
+
+- `crate::native::hex::encode(&bytes)` for response-byte preview hex.
+- `crate::utils::url_encode(s)` (delegates to `crate::native::url_encoding::encode`) for query / form payload encoding.
+- `crate::native::network::*` for raw-socket DoS modules.
+
+---
+
 ## Artifact Handling
 
 If the exploit downloads or writes files (e.g., memory dumps, webshells):