fix: add io.LimitReader to prevent memory exhaustion

Add io.LimitReader with 5MB limit to all HTTP response body reads
to prevent potential memory exhaustion from maliciously large responses.

Affected files:
- pkg/scan/cms.go
- pkg/scan/subdomaintakeover.go
- pkg/scan/js/scan.go
- pkg/scan/js/supabase.go

pkg/scan/cms.go

@@ -56,7 +56,7 @@ func CMS(url string, timeout time.Duration, logdir string) (*CMSResult, error) {
 	}
 	defer resp.Body.Close()
 
-	body, err := io.ReadAll(resp.Body)
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 5*1024*1024))
 	if err != nil {
 		return nil, err
 	}

pkg/scan/js/scan.go

@@ -110,7 +110,7 @@ func JavascriptScan(url string, timeout time.Duration, threads int, logdir strin
 			continue
 		}
 
-		bodyBytes, err := io.ReadAll(resp.Body)
+		bodyBytes, err := io.ReadAll(io.LimitReader(resp.Body, 5*1024*1024))
 		resp.Body.Close()
 		if err != nil {
 			jslog.Errorf("Failed to read script body: %s", err)

pkg/scan/subdomaintakeover.go

@@ -127,7 +127,7 @@ func checkSubdomainTakeover(subdomain string, client *http.Client) (bool, string
 	}
 	defer resp.Body.Close()
 
-	body, err := io.ReadAll(resp.Body)
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 5*1024*1024))
 	if err != nil {
 		return false, ""
 	}