Repository navigation
fix(maa-core): stop-task releases pooled controller & web handler stops blocking the runtime #434
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -1024,7 +1024,27 @@ async fn handle_stop_task( | |
| State(state): State<WebState>, | ||
| axum::extract::Path(instance_id): axum::extract::Path<String>, | ||
| ) -> impl IntoResponse { | ||
| match stop_task_impl(&state.app_handle, &state.maa_state, &instance_id) { | ||
| // [PATCH-ZC-STOP] stop_task_impl 是同步阻塞调用(内部会 post_stop 并等待 | ||
| // 框架事件循环推进)。直接在 axum 的 async worker 线程上执行会阻塞该线程, | ||
| // 导致 post_stop 依赖的任务回调无法被处理,形成死锁——用户表现为 | ||
| // WebUI 点「停止」无反应,只能去托盘右键停止(那条路径走 Tauri 命令, | ||
| // 在独立线程上执行所以正常)。这里包进 spawn_blocking 让它跑在 | ||
| // 阻塞线程池,不占用 async runtime。 | ||
| let app_handle = state.app_handle.clone(); | ||
| let maa_state = state.maa_state.clone(); | ||
| let instance_id_for_task = instance_id.clone(); | ||
|
|
||
| let result = tokio::task::spawn_blocking(move || { | ||
| stop_task_impl(&app_handle, &maa_state, &instance_id_for_task) | ||
| }) | ||
| .await; | ||
|
|
||
| let outcome = match result { | ||
| Ok(inner) => inner, | ||
| Err(join_err) => Err(format!("停止任务线程异常: {join_err}")), | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
When the blocking worker fails (for example by panicking), AGENTS.md reference: AGENTS.md:L40-L41 Useful? React with 👍 / 👎. |
||
| }; | ||
|
|
||
| match outcome { | ||
| Ok(()) => { | ||
| emit_state_changed(&state.app_handle, &instance_id, "task-stopped"); | ||
| Json(serde_json::json!({ "ok": true })).into_response() | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟡 中 · 不受信任的网站可以停止任务
启用 Web 服务器后,如果用户在任务运行期间访问恶意网页,针对未认证的停止路由发起的请求现在会让
stop_task_impl执行完成。恶意网页可以从可读取的/api/maa/state端点获取实例 ID,然后发送 POST 请求停止正在运行的任务;服务器的通配符 CORS 策略允许跨源请求,因此用户的自动化任务会停止。对会修改数据的 Web API 路由要求身份验证,并验证请求来源或 CSRF 令牌。
给 AI 智能体的提示
Original comment in English
🟡 Medium · Untrusted sites can stop tasks
When the web server is enabled and a user visits a malicious webpage while a task is running,
stop_task_implnow runs to completion for requests to the unauthenticated stop route. A malicious webpage can obtain instance IDs from the readable/api/maa/stateendpoint and POST to stop an active task; the server’s wildcard CORS policy allows the cross-origin request, so the user’s automation stops.Require authentication and validate the requesting origin or a CSRF token on mutating web API routes.
Prompt for AI agents