python3Packages.wfuzz: fix Python 3.13 plugin breakage and add netaddr runtime dep (#516508)

maintainers/maintainer-list.nix

@@ -2913,6 +2913,12 @@
     githubId = 1017537;
     name = "Bruno Bieth";
   };
+  bad3r = {
+    name = "Bad3r";
+    email = "github@unsigned.sh";
+    github = "Bad3r";
+    githubId = 25513724;
+  };
   badele = {
     name = "Bruno Adelé";
     email = "brunoadele@gmail.com";

pkgs/development/python-modules/wfuzz/default.nix

@@ -29,12 +29,15 @@ buildPythonPackage (finalAttrs: {
   };
 
   patches = [
-    # replace use of imp module for Python 3.12
+    # replace use of imp module for Python >= 3.12
     # https://github.com/xmendez/wfuzz/pull/365
     (fetchpatch2 {
       url = "https://github.com/xmendez/wfuzz/commit/f4c028b9ada4c36dabf3bc752f69f6ddc110920f.patch?full_index=1";
       hash = "sha256-t7pUMcdFmwAsGUNBRdZr+Jje/yR0yzeGIgeYNEq4hFE=";
     })
+    # replace removed `pipes` stdlib module with `shlex` for Python >= 3.13
+    # https://github.com/xmendez/wfuzz/issues/380
+    ./python-313-shlex.patch
   ];
 
   build-system = [ setuptools ];
@@ -43,10 +46,11 @@ buildPythonPackage (finalAttrs: {
     chardet
     distutils # src/wfuzz/plugin_api/base.py
     legacy-cgi
+    netaddr # src/wfuzz/plugins/payloads/{iprange,ipnet}.py
     pycurl
-    six
-    setuptools
     pyparsing
+    setuptools
+    six
   ]
   ++ lib.optionals stdenv.hostPlatform.isWindows [ colorama ];
 
@@ -84,6 +88,10 @@ buildPythonPackage (finalAttrs: {
     '';
     homepage = "https://wfuzz.readthedocs.io";
     license = with lib.licenses; [ gpl2Only ];
-    maintainers = with lib.maintainers; [ pamplemousse ];
+    maintainers = with lib.maintainers; [
+      bad3r
+      pamplemousse
+    ];
+    mainProgram = "wfuzz";
   };
 })

pkgs/development/python-modules/wfuzz/python-313-shlex.patch

@@ -0,0 +1,29 @@
+Replace removed `pipes` stdlib module with `shlex` in screenshot plugin.
+
+`pipes` was deprecated in Python 3.11 (PEP 594) and removed in 3.13;
+`shlex.quote` is the documented stdlib replacement and behaves identically
+for the single argument used here.
+
+Reported upstream: https://github.com/xmendez/wfuzz/issues/380
+
+diff --git a/src/wfuzz/plugins/scripts/screenshot.py b/src/wfuzz/plugins/scripts/screenshot.py
+--- a/src/wfuzz/plugins/scripts/screenshot.py
++++ b/src/wfuzz/plugins/scripts/screenshot.py
+@@ -3,7 +3,7 @@ from wfuzz.externals.moduleman.plugin import moduleman_plugin
+
+ import subprocess
+ import tempfile
+-import pipes
++import shlex
+ import os
+ import re
+
+@@ -42,7 +42,7 @@ class screenshot(BasePlugin):
+         subprocess.call(
+             [
+                 "cutycapt",
+-                "--url=%s" % pipes.quote(fuzzresult.url),
++                "--url=%s" % shlex.quote(fuzzresult.url),
+                 "--out=%s" % filename,
+                 "--insecure",
+                 "--print-backgrounds=on",