294 lines
14 KiB
Markdown
294 lines
14 KiB
Markdown
# BUGS_FOUND.md
|
||
|
||
## FIXED (2026-05-22 — all 47 resolved)
|
||
|
||
| # | Severity | File(s) | Fix summary |
|
||
|---|----------|---------|-------------|
|
||
| 1 | CRITICAL | orchestrator.py | CAPTCHA → manual-pause mode; no infinite re-queue; documented honestly |
|
||
| 2 | CRITICAL | orchestrator.py | Rate-limited proxy returned to pool via `return_proxy()` instead of dropped |
|
||
| 3 | CRITICAL | login_client.py | Removed broad `facebook.com` catch-all; success requires cookies or explicit URL fragments; added privacy/help/about/terms to failure_url_fragments |
|
||
| 4 | CRITICAL | file_io.py | Added `stream_passwords()` generator; added `count_passwords()`; `load_passwords()` uses streaming |
|
||
| 5 | CRITICAL | orchestrator.py | `_retry_queue` replaces `_password_index -= 1`; workers drain retry queue first; per-password retry cap |
|
||
| 6 | HIGH | password_generator.py | `symbols_between=True` auto-adds `{word}{sym}{num}` and `{num}{sym}{word}` to active patterns |
|
||
| 7 | HIGH | login_client.py | Generic sites: GET login page, scrape all `<input type="hidden">` fields into POST payload |
|
||
| 8 | HIGH | login_client.py | `session.cookies.clear()` called at start of every `attempt_login()` |
|
||
| 9 | HIGH | orchestrator.py | CAPTCHA max-retry enforced: after `_max_captcha_retries` password is skipped, not re-queued |
|
||
| 10 | HIGH | pool.py | `fetch_and_validate()` merges via `add_proxies()` instead of full reset |
|
||
| 11 | HIGH | validator.py | `test_batch_sync` uses `new_event_loop() / run_until_complete() / close()` pattern |
|
||
| 12 | HIGH | file_io.py | `save_valid_proxies()` reads existing file, merges, dedupes, then writes |
|
||
| 13 | HIGH | setup_tab.py | `pull_model` iterates `resp.iter_lines()`, returns True only on `"status":"success"` |
|
||
| 14 | HIGH | captcha/*.py | Added pipeline docstrings: "manual from Setup tab only; will be wired in future release" |
|
||
| 15 | HIGH | attack_tab.py | Added Direct Mode CTkCheckBox; no-proxy start shows confirmation dialog |
|
||
| 16 | MEDIUM | password_generator.py, password_builder_tab.py | `estimate()` docstring and UI label say "upper bound" |
|
||
| 17 | MEDIUM | combinatorics.py | `generate_number_suffixes()` has `max_count=5000` cap |
|
||
| 18 | MEDIUM | file_io.py | `save_passwords(dedupe=True)` loads existing, unions, dedupes, writes |
|
||
| 19 | MEDIUM | pool.py | `mark_dead()` rebuilds queue from `_all_valid` after removal |
|
||
| 20 | MEDIUM | pool.py | Low-water qsize check moved inside `with self._lock:` block |
|
||
| 21 | MEDIUM | config.py | Removed `PROXIFLY_API_KEY/URL/FALLBACK_URL` |
|
||
| 22 | MEDIUM | fetcher.py | `_IP_PORT_RE` extended to match `hostname:port` patterns |
|
||
| 23 | MEDIUM | setup_tab.py | `_on_save_config` starts from `DEFAULT_OLLAMA_CONFIG`, merges all keys |
|
||
| 24 | MEDIUM | app.py, setup_tab.py | `GODCWAKApp` creates `self.captcha_solver`; setup_tab reloads shared instance |
|
||
| 25 | MEDIUM | ollama_client.py | Replaced shallow regex with balanced-brace extractor + fenced-block support |
|
||
| 26 | MEDIUM | orchestrator.py, attack_tab.py | Added `passwords_completed` field; UI uses completions not dispatch index |
|
||
| 27 | MEDIUM | main.py | `check_dependencies()` now checks `aiohttp` and `aiohttp_socks` |
|
||
| 28 | MEDIUM | requirements.txt | Removed pandas/colorama/python-dotenv; added playwright as optional comment |
|
||
| 29 | MEDIUM | logs_tab.py | CSV export uses `encoding="utf-8-sig"` for Excel BOM compatibility |
|
||
| 30 | MEDIUM | file_io.py | `load_passwords()` deduplicates with `dict.fromkeys()` preserving order |
|
||
| 31 | MEDIUM | password_builder_tab.py | `camel_case` omitted from UI (duplicates first_letter_caps); `sequential_numbers` defaults off |
|
||
| 32 | MEDIUM | pool.py | `_refresh_worker` logs WARNING when 0 proxies added; stores `_last_refresh_count` |
|
||
| 33 | LOW | captcha_solver.py | `_model_family()` now called from `_default_prompt()` to select OCR vs vision prompt |
|
||
| 34 | LOW | captcha_solver.py | `_parse_answer` tile mode: `digit_count >= 1` (was `>= 2`) |
|
||
| 35 | LOW | config.py, main.py | `DATA_DIR.mkdir()` moved to `ensure_dirs()` function; called at startup |
|
||
| 36 | LOW | GODCWAK.bat | First-run detection: checks `.installed` sentinel; runs pip install on first launch |
|
||
| 37 | LOW | pool.py | Stale "Proxifly" reference removed from `fetch_and_validate` |
|
||
| 38 | LOW | requirements.txt | Already covered by #28 |
|
||
| 39 | LOW | browser_controller.py | Missing browser error caught specifically; logs "Run: playwright install chromium" |
|
||
| 40 | LOW | orchestrator.py | `stop()` sets `_stop_event`; workers check it; `join(timeout=3.0)` on all threads |
|
||
| 41 | UI/UX | workflow.py, setup/attack/logs tabs | Reordered: 01 PW Builder, 02 Proxy, 03 Setup, 04 Attack, 05 Logs |
|
||
| 42 | UI/UX | attack_tab.py | Proxies chip now says "✗ NEED PROXIES" (red) not "optional" |
|
||
| 43 | UI/UX | proxy_manager_tab.py | TEST ALL runs 10 concurrent threads (semaphore); reduces test time ~10× |
|
||
| 44 | UI/UX | password_builder_tab.py | Min/max sliders clamp each other so min ≤ max is always enforced |
|
||
| 45 | UI/UX | proxy_manager_tab.py | Saved proxies load as orange "SAVED" state; green only after live TEST |
|
||
| 46 | UI/UX | password_builder_tab.py | CANCEL button appears during generation; sets `_cancel_generation` flag |
|
||
| 47 | UI/UX | attack_tab.py | Live log truncation increased from 28 → 50 chars for proxy and password |
|
||
|
||
---
|
||
|
||
> Full bug hunt & edge-case audit — GODCWAK (Python 3.12)
|
||
> Date: 2026-05-22
|
||
> All `.py` files compile. Import smoke tests pass. Issues below are from code review + targeted runtime checks.
|
||
|
||
---
|
||
|
||
## Summary
|
||
|
||
| Severity | Count |
|
||
|----------|------:|
|
||
| CRITICAL | 5 |
|
||
| HIGH | 10 |
|
||
| MEDIUM | 17 |
|
||
| LOW | 8 |
|
||
| UI/UX | 7 |
|
||
| **Total** | **47** |
|
||
|
||
---
|
||
|
||
## CRITICAL
|
||
|
||
### 1. CAPTCHA detected but never solved during attack
|
||
**Files:** `src/attack/orchestrator.py`, `src/gui/attack_tab.py`, `src/captcha/*`
|
||
**Issue:** Orchestrator only calls `on_captcha(proxy)` — no screenshot, no `CaptchaSolver`, no browser. Attack tab logs and flashes border. Full CAPTCHA pipeline (`screenshotter`, `coord_mapper`, `ollama_client`, `browser_controller`) is dead code.
|
||
**Edge case:** Any CAPTCHA response → infinite re-queue loop.
|
||
**Fix:** Wire capture → Ollama solve → submit answer (or pause for manual solve).
|
||
|
||
### 2. Rate-limited proxies leak from pool
|
||
**Files:** `src/attack/orchestrator.py` → `_release_proxy_after_attempt`
|
||
**Issue:** On rate limit, proxy is dropped (`current_proxy = None`) but never `return_proxy()` or `mark_dead()`.
|
||
**Edge case:** Pool drains over long runs with rate limits.
|
||
**Fix:** Return to pool after cooldown or quarantine queue.
|
||
|
||
### 3. Facebook false-positive login success
|
||
**Files:** `src/attack/login_client.py` → `_analyse`
|
||
**Issue:** URL containing `facebook.com` without `login` can be marked SUCCESS without `c_user`/`xs` cookies (e.g. privacy/checkpoint pages).
|
||
**Edge case:** `https://www.facebook.com/privacy/...` → bogus SUCCESS.
|
||
**Fix:** Require success cookies or explicit success URL fragments only.
|
||
|
||
### 4. Full wordlist loaded into RAM on START
|
||
**Files:** `src/gui/attack_tab.py`, `src/utils/file_io.py`
|
||
**Issue:** `load_passwords()` reads entire `data/passwords.txt` into a list.
|
||
**Edge case:** GPU-generated millions of passwords → OOM / GUI freeze.
|
||
**Fix:** Streaming password iterator + resume checkpoint.
|
||
|
||
### 5. Password index race on re-queue
|
||
**Files:** `src/attack/orchestrator.py`
|
||
**Issue:** `_password_index -= 1` on no-proxy/CAPTCHA under lock, but multiple workers can still duplicate the same password.
|
||
**Edge case:** Empty proxy pool + 3 workers → same password tried in parallel.
|
||
**Fix:** Per-password retry queue or per-worker cursors.
|
||
|
||
---
|
||
|
||
## HIGH
|
||
|
||
### 6. `symbols_between` checkbox does nothing
|
||
**Files:** `src/engine/password_generator.py`, `src/gui/password_builder_tab.py`
|
||
**Issue:** Flag only gates symbol list building; no `{sym}`-between pattern logic. Verified: `{word}{num}` only → no symbols inserted.
|
||
**Fix:** Auto-add `{word}{sym}{num}` patterns when enabled, or remove checkbox.
|
||
|
||
### 7. Generic sites POST without CSRF tokens
|
||
**Files:** `src/attack/login_client.py` → `SiteConfig.for_url`
|
||
**Issue:** Clears `token_patterns`; most sites reject bare username/password POST.
|
||
**Fix:** Auto-scrape hidden inputs or user-defined token map in Attack tab.
|
||
|
||
### 8. Thread-local session keeps cookies across passwords
|
||
**Files:** `src/attack/login_client.py`
|
||
**Issue:** Worker reuses one session for all attempts; failed login may pollute cookies for next password.
|
||
**Fix:** Clear cookies per attempt or new session per password.
|
||
|
||
### 9. CAPTCHA max retry is logged but not enforced
|
||
**Files:** `src/attack/orchestrator.py`
|
||
**Issue:** After `_max_captcha_retries`, still re-queues same password forever.
|
||
**Fix:** Skip password or halt with user prompt.
|
||
|
||
### 10. `fetch_and_validate` resets entire pool
|
||
**Files:** `src/proxy/pool.py`
|
||
**Issue:** Replaces `_all_valid` and rebuilds queue; ignores in-flight proxies. Not GUI-wired but dangerous if called during attack.
|
||
**Fix:** Merge new proxies instead of full reset.
|
||
|
||
### 11. `asyncio.run()` from background threads
|
||
**Files:** `src/proxy/validator.py`, `src/proxy/pool.py`
|
||
**Issue:** New event loop per validation batch from daemon threads; fragile under load.
|
||
**Fix:** Dedicated async thread or sync HTTP validator.
|
||
|
||
### 12. Proxy COMMIT overwrites saved file
|
||
**Files:** `src/gui/proxy_manager_tab.py`, `src/utils/file_io.py`
|
||
**Issue:** `save_valid_proxies` writes only current UI greens; prior committed proxies lost.
|
||
**Fix:** Merge + dedupe on commit.
|
||
|
||
### 13. `OllamaManager.pull_model` false success
|
||
**Files:** `src/gui/setup_tab.py`
|
||
**Issue:** Returns True on HTTP 200 without consuming pull stream.
|
||
**Fix:** Iterate stream until `"status":"success"`.
|
||
|
||
### 14. CAPTCHA pipeline modules unused
|
||
**Files:** `src/captcha/ollama_client.py`, `coord_mapper.py`, `screenshotter.py`, `browser_controller.py`
|
||
**Issue:** Never imported from attack/GUI flow.
|
||
**Fix:** Wire or remove.
|
||
|
||
### 15. Attack starts with zero proxies
|
||
**Files:** `src/gui/attack_tab.py`
|
||
**Issue:** Warns but allows START; all traffic from real IP.
|
||
**Fix:** Block START or explicit “direct mode” toggle.
|
||
|
||
---
|
||
|
||
## MEDIUM
|
||
|
||
### 16. Password estimate diverges from actual count
|
||
**Files:** `src/engine/password_generator.py`
|
||
|
||
### 17. `generate_number_suffixes` combinatorial explosion (0–9999 + padding variants)
|
||
**Files:** `src/engine/combinatorics.py`
|
||
|
||
### 18. `save_passwords` always appends → duplicate wordlist bloat
|
||
**Files:** `src/utils/file_io.py`, `password_builder_tab.py`
|
||
|
||
### 19. `mark_dead` doesn’t remove proxy already sitting in queue
|
||
**Files:** `src/proxy/pool.py`
|
||
|
||
### 20. Low-water proxy refresh race (`qsize()` outside lock)
|
||
**Files:** `src/proxy/pool.py`
|
||
|
||
### 21. Dead `PROXIFLY_*` config keys
|
||
**Files:** `config.py`
|
||
|
||
### 22. Proxy fetcher IPv4-only regex (no hostnames/IPv6)
|
||
**Files:** `src/proxy/fetcher.py`
|
||
|
||
### 23. Setup save omits some fields (`top_p`, timeout) from JSON
|
||
**Files:** `src/gui/setup_tab.py`
|
||
|
||
### 24. Save config creates throwaway `CaptchaSolver` — no global instance
|
||
**Files:** `src/gui/setup_tab.py`
|
||
|
||
### 25. `OllamaVisionClient._parse_response` shallow JSON regex
|
||
**Files:** `src/captcha/ollama_client.py`
|
||
|
||
### 26. `stats.passwords_tried` tracks dispatch index, not completions
|
||
**Files:** `src/attack/orchestrator.py`
|
||
|
||
### 27. `main.check_dependencies` missing aiohttp/aiohttp-socks
|
||
**Files:** `main.py`
|
||
|
||
### 28. `requirements.txt` mismatch (mandatory cupy/pandas unused; optional playwright missing)
|
||
**Files:** `requirements.txt`
|
||
|
||
### 29. Logs CSV export missing `encoding="utf-8"` on Windows
|
||
**Files:** `src/gui/logs_tab.py`
|
||
|
||
### 30. No deduplication when loading wordlist for attack
|
||
**Files:** `src/utils/file_io.py`, `attack_tab.py`
|
||
|
||
### 31. `sequential_numbers` / `camel_case` in config but not in UI
|
||
**Files:** `GenerationConfig`, `password_builder_tab.py`
|
||
|
||
### 32. Background proxy refresh silent (300 proxies, no UI feedback)
|
||
**Files:** `src/proxy/pool.py`
|
||
|
||
---
|
||
|
||
## LOW
|
||
|
||
### 33. `CaptchaSolver._model_family()` defined but never called
|
||
**Files:** `src/captcha/captcha_solver.py`
|
||
|
||
### 34. `_parse_answer` requires ≥2 digits for tile CAPTCHAs
|
||
**Files:** `src/captcha/captcha_solver.py`
|
||
|
||
### 35. `config.py` creates `data/` at import time (side effect)
|
||
**Files:** `config.py`
|
||
|
||
### 36. `GODCWAK.bat` doesn’t run `pip install` on first launch
|
||
**Files:** `GODCWAK.bat`
|
||
|
||
### 37. Stale “Proxifly” docstring in `fetch_and_validate`
|
||
**Files:** `src/proxy/pool.py`
|
||
|
||
### 38. Unused deps: `pandas`, `colorama`, `python-dotenv`
|
||
**Files:** `requirements.txt`
|
||
|
||
### 39. Playwright launch assumes browsers already installed
|
||
**Files:** `src/captcha/browser_controller.py`
|
||
|
||
### 40. `stop()` doesn’t join worker threads (slow shutdown)
|
||
**Files:** `src/attack/orchestrator.py`
|
||
|
||
---
|
||
|
||
## UI/UX
|
||
|
||
### 41. Workflow puts Setup (AI) as step 05 — after Attack
|
||
**Files:** `src/gui/workflow.py`
|
||
|
||
### 42. Readiness says proxies optional; attack warns they’re missing
|
||
**Files:** `src/gui/attack_tab.py`
|
||
|
||
### 43. TEST ALL is one-at-a-time (500 proxies × 10s = ~80 min)
|
||
**Files:** `src/gui/proxy_manager_tab.py`
|
||
|
||
### 44. Password Builder allows min length > max length
|
||
**Files:** `src/gui/password_builder_tab.py`
|
||
|
||
### 45. Saved proxies load as green without re-test
|
||
**Files:** `src/gui/proxy_manager_tab.py`
|
||
|
||
### 46. GENERATE has no cancel button
|
||
**Files:** `src/gui/password_builder_tab.py`
|
||
|
||
### 47. Live log truncates proxy/password to 28 characters
|
||
**Files:** `src/gui/attack_tab.py`
|
||
|
||
---
|
||
|
||
## Verified working
|
||
|
||
- All Python modules compile (`py_compile`)
|
||
- Import smoke tests pass
|
||
- `CaptchaSolver._parse_answer` (text + tile cases)
|
||
- Proxy pool `return_proxy` / `mark_dead` basic behavior
|
||
- 3-part pattern `{word}{sym}{num}` generation (CPU path)
|
||
- CSRF token scrape on realistic HTML (`lsd`, `fb_dtsg`, `jazoest`)
|
||
- GUI launches (`GODCWAKApp` init)
|
||
- Status bar, workflow ribbon, tab headers (recent pass)
|
||
|
||
---
|
||
|
||
## Fix priority (recommended order)
|
||
|
||
1. CAPTCHA pipeline wired into attack (or honest “manual only” mode)
|
||
2. Rate-limit proxy leak + password index race
|
||
3. Facebook / generic login success detection
|
||
4. Streaming wordlist + dedupe on save/load
|
||
5. Proxy commit merge + session cookie clear per attempt
|
||
6. UI consistency (Setup before Attack, proxy required vs optional)
|
||
7. Requirements cleanup + dependency check completeness
|