fix: explore pole/antimeridian output + entropy read cap (audit findings)

Final adversarial security+correctness audit of the new modules: 0 Critical/
High (SSRF, untrusted-data crash, key leak all ruled out; TLS verified). Fixed:
- explore_cast (MEDIUM): at lat=±90 cos(lat)->0 emitted target.lon ~1.9e14.
  Clamp the projection latitude (±89.9) and normalize output lon to [-180,180).
- entropy (LOW): cap resp.read(1<<20) so a misbehaving endpoint can't stream an
  unbounded body.
- tests/test_explore.py (+6, 1001->1007): pole/antimeridian regression — target
  finite, in [-180,180], within radius.

Author: ShousenZHANG

scripts/entropy.py

@@ -48,7 +48,9 @@ def _fetch_quantum_bytes(n: int, timeout: float = 6.0) -> bytes | None:
                 f"{_ANU_LEGACY_URL}?length={n}&type=uint8"
             )
         with urllib.request.urlopen(req, timeout=timeout) as resp:  # noqa: S310
-            payload = json.loads(resp.read().decode("utf-8"))
+            # Cap the read: a compromised/misbehaving endpoint ignoring length=
+            # must not stream an unbounded body into memory.
+            payload = json.loads(resp.read(1 << 20).decode("utf-8"))
         if payload.get("success") and isinstance(payload.get("data"), list):
             data = bytes(int(b) & 0xFF for b in payload["data"])
             return data[:n] if len(data) >= n else None

scripts/explore_cast.py

@@ -28,6 +28,18 @@
 from utils import json_print
 
 EARTH_M_PER_DEG = 111_320.0  # metres per degree of latitude (mean)
+MAX_PROJ_LAT = 89.9          # clamp for the cos(lat) longitude projection
+
+
+def _cos_lat(lat: float) -> float:
+    """cos(latitude) clamped away from the poles so the longitude projection
+    never explodes (cos -> 0 at ±90 would blow dx/(cos) up to ~1e14)."""
+    return math.cos(math.radians(max(-MAX_PROJ_LAT, min(MAX_PROJ_LAT, lat))))
+
+
+def _norm_lon(lon: float) -> float:
+    """Wrap longitude into [-180, 180)."""
+    return ((lon + 180.0) % 360.0) - 180.0
 
 # 后天八卦 -> compass bearing (degrees, 0=N clockwise).
 BAGUA_BEARING: dict[str, float] = {
@@ -46,7 +58,7 @@
 def random_points(lat: float, lon: float, radius_m: float, n: int, rng):
     """n uniformly-distributed points within radius_m of (lat, lon)."""
     pts = []
-    cos_lat = math.cos(math.radians(lat)) or 1e-9
+    cos_lat = _cos_lat(lat) or 1e-9
     for _ in range(n):
         r = radius_m * math.sqrt(rng.random())   # sqrt for uniform area
         theta = 2 * math.pi * rng.random()
@@ -62,7 +74,7 @@ def find_anomaly(pts, origin, radius_m, mode, grid=16):
     being grid-density, not gaussian KDE). Returns (target_lat, target_lon, z)."""
     olat, olon = origin
     span = radius_m / EARTH_M_PER_DEG  # half-extent in degrees lat
-    cos_lat = math.cos(math.radians(olat)) or 1e-9
+    cos_lat = _cos_lat(olat) or 1e-9
     span_lon = span / cos_lat
 
     if mode == "blindspot":
@@ -193,6 +205,8 @@ def main(argv: list[str] | None = None) -> int:
     rng = entropy.get_rng(args.seed, args.entropy)
     pts = random_points(args.lat, args.lon, args.radius, n, rng)
     tlat, tlon, z = find_anomaly(pts, (args.lat, args.lon), args.radius, args.mode)
+    tlat = max(-90.0, min(90.0, tlat))
+    tlon = _norm_lon(tlon)
 
     dist = haversine_m(args.lat, args.lon, tlat, tlon)
     brg = bearing_deg(args.lat, args.lon, tlat, tlon)

tests/test_explore.py

@@ -36,6 +36,20 @@ def test_determinism_with_seed():
     assert a["target"] == b["target"]
 
 
+@pytest.mark.parametrize("lat,lon", [
+    (90, 0), (-90, 0), (89.95, 10), (0, 179.999), (0, -180), (0, 180),
+])
+def test_pole_and_antimeridian_output_finite_and_in_range(lat, lon):
+    """REGRESSION: at the poles cos(lat)->0 used to emit target.lon ~1.9e14;
+    near ±180 the lon must wrap into range. Target must stay sane + in radius."""
+    d = run("--lat", lat, "--lon", lon, "--radius", 2000, "--seed", 1)
+    assert d["ok"] is True
+    t = d["target"]
+    assert -90.0 <= t["lat"] <= 90.0
+    assert -180.0 <= t["lon"] <= 180.0
+    assert d["distance_m"] <= 2000.1
+
+
 def test_entropy_and_safety_and_disclaimer_present():
     d = run("--lat", 1.0, "--lon", 1.0, "--seed", 3)
     assert d["entropy"]["source"] == "seed"