fix: normalize source-reported subdomains before domain check

[krishna28238-arch]

Sources that report hosts verbatim — certificate names from certspotter/censys, code-search matches from github, FQDNs from DNS-style APIs — can return values with a trailing dot or mixed case. The suffix check in the enumerator is case- and dot-sensitive, so these results are silently dropped (dnsdb and dnsrepo already trim the dot at the source to work around this).

This normalizes the value once, centrally, before the check, mirroring what preprocessDomain does for input domains and what the regex extractor already does for text sources. Values that already pass are unaffected, and apexes, label fusions (notexample.com) and other-apex hosts (foo.example.com.evil.org) are still rejected.

Summary by CodeRabbit

• Bug Fixes
  • Improved subdomain handling by normalizing capitalization and trailing dots before wildcard and domain matching.
  • Ensured valid fully qualified domain names are recognized consistently, while non-matching and spoofed domain values remain rejected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 49a414aa-da11-4ce5-8962-79d32f875d27

📥 Commits

Reviewing files that changed from the base of the PR and between 7a0b91f and fc4f14e.

📒 Files selected for processing (3)

• pkg/runner/enumerate.go
• pkg/runner/util.go
• pkg/runner/util_test.go

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

Walkthrough

The runner now lowercases subdomains and removes trailing FQDN dots before wildcard processing. Tests cover normalization, domain suffix validation, mixed-case hosts, wildcard values, and suffix-spoofing values.

Changes

Subdomain normalization

Layer / File(s)	Summary
Normalization helper and tests pkg/runner/util.go, pkg/runner/util_test.go	Adds normalizeSubdomain, which lowercases values and removes a trailing dot. Tests cover normalization and domain-gate behavior.
Enumeration normalization pkg/runner/enumerate.go	Normalizes enumeration results before wildcard prefix removal and wildcard detection.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to fc4f1

Source-reported subdomains with mixed case or a trailing FQDN dot are now accepted consistently while existing apex and suffix-spoofing rejections remain covered. No current merge-blocking risk is identified.

Poem

A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: normalizing source-reported subdomains before the domain check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}