fix(tasks): testssl JSONDecodeError on concatenated JSON output, duplicate targets collision, missing OpenSSL libproviders.so in Docker image

[sundayz-hunter]

Bug 1 (fixed): JSONDecodeError: Extra data when parsing JSON output

Description

When testssl runs on multiple targets, the --jsonfile output contains multiple concatenated JSON structures. The on_cmd_done() method uses json.load() which expects a single JSON object, causing a JSONDecodeError.

Root Cause

Secator's runner can load the same target multiple times (Loaded 2 targets for testssl with the same host). Each target's testssl run appends to the same output file. The resulting file contains concatenated JSON:

[
     {"id": "engine_problem", ...},
     {"id": "scanProblem", ...}
]
     {
          "id": "scanProblem",
          "finding": "non-empty 'testssl.json' exists. Either use '--append' or (re)move it"
     }

json.load() fails with Extra data: line 24 column 10 (char 909).

Secondary error

After the JSONDecodeError, the cleanup code calls os.killpg() on an already-terminated process, causing ProcessLookupError: [Errno 3] No such process. This is a side effect. The process is already dead.

Traceback

json.decoder.JSONDecodeError: Extra data: line 24 column 10 (char 909)

Traceback (most recent call last):
  File ".../secator/tasks/testssl.py", line 92, in on_cmd_done
    data = json.load(f)
  ...
  json.decoder.JSONDecodeError: Extra data

During handling:
  File ".../secator/runners/command.py", line 645, in stop_process
    os.killpg(os.getpgid(self.process.pid), sig)
ProcessLookupError: [Errno 3] No such process

Fix

Replace json.load(f) with incremental parsing using json.JSONDecoder().raw_decode():

# Before (crashes on concatenated JSON)
with open(self.output_path, 'r') as f:
    data = json.load(f)

# After (handles single array, concatenated arrays/objects, JSONL)
with open(self.output_path, 'r') as f:
    content = f.read()
decoder = json.JSONDecoder()
data = []
pos = 0
while pos < len(content.strip()):
    while pos < len(content) and content[pos] in ' \t\n\r,':
        pos += 1
    if pos >= len(content):
        break
    try:
        obj, end = decoder.raw_decode(content, pos)
        if isinstance(obj, list):
            data.extend(obj)
        else:
            data.append(obj)
        pos = end
    except json.JSONDecodeError:
        break

This handles all observed formats: single JSON array (normal case), concatenated arrays, array + object, JSONL.

---

Bug 2 (needs maintainer input): Duplicate targets write to same output file

Description

The output path in on_cmd() uses self.unique_name which is the same for all instances. When multiple instances of testssl run, they all write to the same file. If the file already exists from a previous run, testssl.sh refuses to overwrite it:

[ERR] non-empty '/home/secator/.secator/reports/.outputs/testssl.json' exists. Either use '--append' or (re)move it

Root Cause

self.unique_name resolves to just testssl regardless of the target, so all instances share the same output path.

Possible approaches (for maintainers to decide)

• Delete the file before each run in on_cmd()
• Use a truly unique path (e.g., with target + UUID)

---

Bug 3 (needs maintainer input): Missing libproviders.so in Docker image

Description

testssl.sh reports being unable to resolve any target:

[ERR] No IPv4/IPv6 address(es) for 'example.com' available

However DNS resolution works fine in the container (nslookup resolves correctly). After investigating, i found that the bundled OpenSSL is missing libproviders.so, which causes testssl.sh to fail before it can scan:

Error configuring OpenSSL
error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:
filename(libproviders.so): libproviders.so: cannot open shared object file: No such file or directory

find confirms no .so files exist in the testssl installation directory (/home/secator/.local/share/testssl.sh_v3.2.0/).

Possible approaches (for maintainers to decide)

• Include OpenSSL provider libraries in the Docker image
• Configure testssl to use the system OpenSSL instead of the bundled one
• Update the testssl.sh installation method

---

Environment

• secator v0.30.1 (Docker image freelabz/secator:0.30.1)
• Python 3.12
• testssl.sh v3.2.0
• Tested via Celery worker in Docker

[ocervell]

The fix for Bug 1 is not what we should do. Instead, we introduced a new flag to isolate the directory where testssl outputs things (#1081), so we should mark testssl as cwd_isolated = True

Bug 2 should have been fixed by PR #1064

Bug 3: I need to investigate more

[ocervell]

Hi there, small update:
Bug 1: fixed by #1081
Bug 2: fixed by #1064
Bug 3: still TBD

@claude can you investigate Bug 3 and make a PR to fix it ?

[claude]

Claude finished @ocervell's task in 4m 53s —— View job • claude/issue-1056-20260605-1201 • Create PR ➔

---

Fix for Bug 3: Missing libproviders.so in Docker image

• Gather context and understand the request
• Investigate Dockerfile and testssl installation
• Investigate testssl task implementation
• Determine best fix approach
• Add extra_env support to Command base class in command.py
• Update testssl.py to set OPENSSL env var to system openssl in on_cmd
• Commit and push changes
• Create PR

Summary

Root cause: testssl.sh bundles its own OpenSSL 3.x binary, but when installed via git clone, the libproviders.so provider library is absent from the bundle. This causes Error configuring OpenSSL before any scan can start, which manifests as [ERR] No IPv4/IPv6 address(es) for 'example.com' available.

Fix: testssl.sh respects the OPENSSL environment variable to override which binary it uses. By setting it to the system openssl (which is installed in all Docker images and has all required providers), we bypass the broken bundled binary entirely.

Changes:

• secator/runners/command.py: Added extra_env = {} class attribute to Command and merged it into the subprocess environment — a generally useful addition for any task that needs to inject env vars.
• secator/tasks/testssl.py: Added shutil import and set OPENSSL to the system openssl path via shutil.which('openssl') in the on_cmd hook.

|