14 KiB
BUGS_FOUND.md
FIXED (2026-05-22 — all 47 resolved)
| # | Severity | File(s) | Fix summary |
|---|---|---|---|
| 1 | CRITICAL | orchestrator.py | CAPTCHA → manual-pause mode; no infinite re-queue; documented honestly |
| 2 | CRITICAL | orchestrator.py | Rate-limited proxy returned to pool via return_proxy() instead of dropped |
| 3 | CRITICAL | login_client.py | Removed broad facebook.com catch-all; success requires cookies or explicit URL fragments; added privacy/help/about/terms to failure_url_fragments |
| 4 | CRITICAL | file_io.py | Added stream_passwords() generator; added count_passwords(); load_passwords() uses streaming |
| 5 | CRITICAL | orchestrator.py | _retry_queue replaces _password_index -= 1; workers drain retry queue first; per-password retry cap |
| 6 | HIGH | password_generator.py | symbols_between=True auto-adds {word}{sym}{num} and {num}{sym}{word} to active patterns |
| 7 | HIGH | login_client.py | Generic sites: GET login page, scrape all <input type="hidden"> fields into POST payload |
| 8 | HIGH | login_client.py | session.cookies.clear() called at start of every attempt_login() |
| 9 | HIGH | orchestrator.py | CAPTCHA max-retry enforced: after _max_captcha_retries password is skipped, not re-queued |
| 10 | HIGH | pool.py | fetch_and_validate() merges via add_proxies() instead of full reset |
| 11 | HIGH | validator.py | test_batch_sync uses new_event_loop() / run_until_complete() / close() pattern |
| 12 | HIGH | file_io.py | save_valid_proxies() reads existing file, merges, dedupes, then writes |
| 13 | HIGH | setup_tab.py | pull_model iterates resp.iter_lines(), returns True only on "status":"success" |
| 14 | HIGH | captcha/*.py | Added pipeline docstrings: "manual from Setup tab only; will be wired in future release" |
| 15 | HIGH | attack_tab.py | Added Direct Mode CTkCheckBox; no-proxy start shows confirmation dialog |
| 16 | MEDIUM | password_generator.py, password_builder_tab.py | estimate() docstring and UI label say "upper bound" |
| 17 | MEDIUM | combinatorics.py | generate_number_suffixes() has max_count=5000 cap |
| 18 | MEDIUM | file_io.py | save_passwords(dedupe=True) loads existing, unions, dedupes, writes |
| 19 | MEDIUM | pool.py | mark_dead() rebuilds queue from _all_valid after removal |
| 20 | MEDIUM | pool.py | Low-water qsize check moved inside with self._lock: block |
| 21 | MEDIUM | config.py | Removed PROXIFLY_API_KEY/URL/FALLBACK_URL |
| 22 | MEDIUM | fetcher.py | _IP_PORT_RE extended to match hostname:port patterns |
| 23 | MEDIUM | setup_tab.py | _on_save_config starts from DEFAULT_OLLAMA_CONFIG, merges all keys |
| 24 | MEDIUM | app.py, setup_tab.py | GODCWAKApp creates self.captcha_solver; setup_tab reloads shared instance |
| 25 | MEDIUM | ollama_client.py | Replaced shallow regex with balanced-brace extractor + fenced-block support |
| 26 | MEDIUM | orchestrator.py, attack_tab.py | Added passwords_completed field; UI uses completions not dispatch index |
| 27 | MEDIUM | main.py | check_dependencies() now checks aiohttp and aiohttp_socks |
| 28 | MEDIUM | requirements.txt | Removed pandas/colorama/python-dotenv; added playwright as optional comment |
| 29 | MEDIUM | logs_tab.py | CSV export uses encoding="utf-8-sig" for Excel BOM compatibility |
| 30 | MEDIUM | file_io.py | load_passwords() deduplicates with dict.fromkeys() preserving order |
| 31 | MEDIUM | password_builder_tab.py | camel_case omitted from UI (duplicates first_letter_caps); sequential_numbers defaults off |
| 32 | MEDIUM | pool.py | _refresh_worker logs WARNING when 0 proxies added; stores _last_refresh_count |
| 33 | LOW | captcha_solver.py | _model_family() now called from _default_prompt() to select OCR vs vision prompt |
| 34 | LOW | captcha_solver.py | _parse_answer tile mode: digit_count >= 1 (was >= 2) |
| 35 | LOW | config.py, main.py | DATA_DIR.mkdir() moved to ensure_dirs() function; called at startup |
| 36 | LOW | GODCWAK.bat | First-run detection: checks .installed sentinel; runs pip install on first launch |
| 37 | LOW | pool.py | Stale "Proxifly" reference removed from fetch_and_validate |
| 38 | LOW | requirements.txt | Already covered by #28 |
| 39 | LOW | browser_controller.py | Missing browser error caught specifically; logs "Run: playwright install chromium" |
| 40 | LOW | orchestrator.py | stop() sets _stop_event; workers check it; join(timeout=3.0) on all threads |
| 41 | UI/UX | workflow.py, setup/attack/logs tabs | Reordered: 01 PW Builder, 02 Proxy, 03 Setup, 04 Attack, 05 Logs |
| 42 | UI/UX | attack_tab.py | Proxies chip now says "✗ NEED PROXIES" (red) not "optional" |
| 43 | UI/UX | proxy_manager_tab.py | TEST ALL runs 10 concurrent threads (semaphore); reduces test time ~10× |
| 44 | UI/UX | password_builder_tab.py | Min/max sliders clamp each other so min ≤ max is always enforced |
| 45 | UI/UX | proxy_manager_tab.py | Saved proxies load as orange "SAVED" state; green only after live TEST |
| 46 | UI/UX | password_builder_tab.py | CANCEL button appears during generation; sets _cancel_generation flag |
| 47 | UI/UX | attack_tab.py | Live log truncation increased from 28 → 50 chars for proxy and password |
Full bug hunt & edge-case audit — GODCWAK (Python 3.12)
Date: 2026-05-22
All.pyfiles compile. Import smoke tests pass. Issues below are from code review + targeted runtime checks.
Summary
| Severity | Count |
|---|---|
| CRITICAL | 5 |
| HIGH | 10 |
| MEDIUM | 17 |
| LOW | 8 |
| UI/UX | 7 |
| Total | 47 |
CRITICAL
1. CAPTCHA detected but never solved during attack
Files: src/attack/orchestrator.py, src/gui/attack_tab.py, src/captcha/*
Issue: Orchestrator only calls on_captcha(proxy) — no screenshot, no CaptchaSolver, no browser. Attack tab logs and flashes border. Full CAPTCHA pipeline (screenshotter, coord_mapper, ollama_client, browser_controller) is dead code.
Edge case: Any CAPTCHA response → infinite re-queue loop.
Fix: Wire capture → Ollama solve → submit answer (or pause for manual solve).
2. Rate-limited proxies leak from pool
Files: src/attack/orchestrator.py → _release_proxy_after_attempt
Issue: On rate limit, proxy is dropped (current_proxy = None) but never return_proxy() or mark_dead().
Edge case: Pool drains over long runs with rate limits.
Fix: Return to pool after cooldown or quarantine queue.
3. Facebook false-positive login success
Files: src/attack/login_client.py → _analyse
Issue: URL containing facebook.com without login can be marked SUCCESS without c_user/xs cookies (e.g. privacy/checkpoint pages).
Edge case: https://www.facebook.com/privacy/... → bogus SUCCESS.
Fix: Require success cookies or explicit success URL fragments only.
4. Full wordlist loaded into RAM on START
Files: src/gui/attack_tab.py, src/utils/file_io.py
Issue: load_passwords() reads entire data/passwords.txt into a list.
Edge case: GPU-generated millions of passwords → OOM / GUI freeze.
Fix: Streaming password iterator + resume checkpoint.
5. Password index race on re-queue
Files: src/attack/orchestrator.py
Issue: _password_index -= 1 on no-proxy/CAPTCHA under lock, but multiple workers can still duplicate the same password.
Edge case: Empty proxy pool + 3 workers → same password tried in parallel.
Fix: Per-password retry queue or per-worker cursors.
HIGH
6. symbols_between checkbox does nothing
Files: src/engine/password_generator.py, src/gui/password_builder_tab.py
Issue: Flag only gates symbol list building; no {sym}-between pattern logic. Verified: {word}{num} only → no symbols inserted.
Fix: Auto-add {word}{sym}{num} patterns when enabled, or remove checkbox.
7. Generic sites POST without CSRF tokens
Files: src/attack/login_client.py → SiteConfig.for_url
Issue: Clears token_patterns; most sites reject bare username/password POST.
Fix: Auto-scrape hidden inputs or user-defined token map in Attack tab.
8. Thread-local session keeps cookies across passwords
Files: src/attack/login_client.py
Issue: Worker reuses one session for all attempts; failed login may pollute cookies for next password.
Fix: Clear cookies per attempt or new session per password.
9. CAPTCHA max retry is logged but not enforced
Files: src/attack/orchestrator.py
Issue: After _max_captcha_retries, still re-queues same password forever.
Fix: Skip password or halt with user prompt.
10. fetch_and_validate resets entire pool
Files: src/proxy/pool.py
Issue: Replaces _all_valid and rebuilds queue; ignores in-flight proxies. Not GUI-wired but dangerous if called during attack.
Fix: Merge new proxies instead of full reset.
11. asyncio.run() from background threads
Files: src/proxy/validator.py, src/proxy/pool.py
Issue: New event loop per validation batch from daemon threads; fragile under load.
Fix: Dedicated async thread or sync HTTP validator.
12. Proxy COMMIT overwrites saved file
Files: src/gui/proxy_manager_tab.py, src/utils/file_io.py
Issue: save_valid_proxies writes only current UI greens; prior committed proxies lost.
Fix: Merge + dedupe on commit.
13. OllamaManager.pull_model false success
Files: src/gui/setup_tab.py
Issue: Returns True on HTTP 200 without consuming pull stream.
Fix: Iterate stream until "status":"success".
14. CAPTCHA pipeline modules unused
Files: src/captcha/ollama_client.py, coord_mapper.py, screenshotter.py, browser_controller.py
Issue: Never imported from attack/GUI flow.
Fix: Wire or remove.
15. Attack starts with zero proxies
Files: src/gui/attack_tab.py
Issue: Warns but allows START; all traffic from real IP.
Fix: Block START or explicit “direct mode” toggle.
MEDIUM
16. Password estimate diverges from actual count
Files: src/engine/password_generator.py
17. generate_number_suffixes combinatorial explosion (0–9999 + padding variants)
Files: src/engine/combinatorics.py
18. save_passwords always appends → duplicate wordlist bloat
Files: src/utils/file_io.py, password_builder_tab.py
19. mark_dead doesn’t remove proxy already sitting in queue
Files: src/proxy/pool.py
20. Low-water proxy refresh race (qsize() outside lock)
Files: src/proxy/pool.py
21. Dead PROXIFLY_* config keys
Files: config.py
22. Proxy fetcher IPv4-only regex (no hostnames/IPv6)
Files: src/proxy/fetcher.py
23. Setup save omits some fields (top_p, timeout) from JSON
Files: src/gui/setup_tab.py
24. Save config creates throwaway CaptchaSolver — no global instance
Files: src/gui/setup_tab.py
25. OllamaVisionClient._parse_response shallow JSON regex
Files: src/captcha/ollama_client.py
26. stats.passwords_tried tracks dispatch index, not completions
Files: src/attack/orchestrator.py
27. main.check_dependencies missing aiohttp/aiohttp-socks
Files: main.py
28. requirements.txt mismatch (mandatory cupy/pandas unused; optional playwright missing)
Files: requirements.txt
29. Logs CSV export missing encoding="utf-8" on Windows
Files: src/gui/logs_tab.py
30. No deduplication when loading wordlist for attack
Files: src/utils/file_io.py, attack_tab.py
31. sequential_numbers / camel_case in config but not in UI
Files: GenerationConfig, password_builder_tab.py
32. Background proxy refresh silent (300 proxies, no UI feedback)
Files: src/proxy/pool.py
LOW
33. CaptchaSolver._model_family() defined but never called
Files: src/captcha/captcha_solver.py
34. _parse_answer requires ≥2 digits for tile CAPTCHAs
Files: src/captcha/captcha_solver.py
35. config.py creates data/ at import time (side effect)
Files: config.py
36. GODCWAK.bat doesn’t run pip install on first launch
Files: GODCWAK.bat
37. Stale “Proxifly” docstring in fetch_and_validate
Files: src/proxy/pool.py
38. Unused deps: pandas, colorama, python-dotenv
Files: requirements.txt
39. Playwright launch assumes browsers already installed
Files: src/captcha/browser_controller.py
40. stop() doesn’t join worker threads (slow shutdown)
Files: src/attack/orchestrator.py
UI/UX
41. Workflow puts Setup (AI) as step 05 — after Attack
Files: src/gui/workflow.py
42. Readiness says proxies optional; attack warns they’re missing
Files: src/gui/attack_tab.py
43. TEST ALL is one-at-a-time (500 proxies × 10s = ~80 min)
Files: src/gui/proxy_manager_tab.py
44. Password Builder allows min length > max length
Files: src/gui/password_builder_tab.py
45. Saved proxies load as green without re-test
Files: src/gui/proxy_manager_tab.py
46. GENERATE has no cancel button
Files: src/gui/password_builder_tab.py
47. Live log truncates proxy/password to 28 characters
Files: src/gui/attack_tab.py
Verified working
- All Python modules compile (
py_compile) - Import smoke tests pass
CaptchaSolver._parse_answer(text + tile cases)- Proxy pool
return_proxy/mark_deadbasic behavior - 3-part pattern
{word}{sym}{num}generation (CPU path) - CSRF token scrape on realistic HTML (
lsd,fb_dtsg,jazoest) - GUI launches (
GODCWAKAppinit) - Status bar, workflow ribbon, tab headers (recent pass)
Fix priority (recommended order)
- CAPTCHA pipeline wired into attack (or honest “manual only” mode)
- Rate-limit proxy leak + password index race
- Facebook / generic login success detection
- Streaming wordlist + dedupe on save/load
- Proxy commit merge + session cookie clear per attempt
- UI consistency (Setup before Attack, proxy required vs optional)
- Requirements cleanup + dependency check completeness