Skip to content

fix: abort scan-from-url downloads on cancel; cap download size (#136)#162

Merged
eboudrant merged 1 commit into
mainfrom
fix/abort-scan-from-url-download
Jul 2, 2026
Merged

fix: abort scan-from-url downloads on cancel; cap download size (#136)#162
eboudrant merged 1 commit into
mainfrom
fix/abort-scan-from-url-download

Conversation

@eboudrant

Copy link
Copy Markdown
Owner

Summary

Closes #136. Cancelling a scan-from-url job didn't abort the in-flight download — runFetch only checked the cancel flag after downloadToTemp resolved, so a large tarball kept streaming to disk. There was also no download size cap or partial-file cleanup.

Changes

  • src/remoteFetch.js: downloadToTemp(url, { signal }) — the AbortSignal reaches both fetch and the stream pipeline; MAX_DOWNLOAD_BYTES (2 GB) enforced via content-length and a byte-counting Transform (covers chunked bodies with no content-length); on any failure the temp dir is removed before rethrowing; aborts normalize to download cancelled.
  • src/scanJobs.js: each fetch job carries an AbortController; cancelJob aborts it immediately; a cancel-triggered abort finishes the job as cancelled, not failed.
  • tests/node/remoteFetch.test.js: new suite — abort mid-download rejects with download cancelled and leaks no temp dir; over-cap content-length rejects with download too large.

Test plan

  • npm test155/155 (new tests included, suite runs in ~1 s).
  • Backend-only → baselines unaffected.

Note

Branch predates the P0 merges that touched src/scanJobs.js (#153/#154) — I'll rebase it onto main once the P0 queue completes.

Not enabling auto-merge.


Generated by Claude Code

@eboudrant eboudrant force-pushed the fix/abort-scan-from-url-download branch from ecb84bb to dfd2fe8 Compare July 2, 2026 06:20
Cancelling a scan-from-url job now aborts the in-flight download via an
AbortController wired from cancelJob through downloadToTemp (fetch + stream
pipeline). Adds a 2 GB MAX_DOWNLOAD_BYTES cap (content-length check up front,
byte-counting Transform during streaming) and cleans up the partial temp dir
on any failure. Closes #136.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BxexPASV1UbMj8ede48RLu
https://claude.ai/code/session_01BxexPASV1UbMj8ede48RLu
@eboudrant eboudrant force-pushed the fix/abort-scan-from-url-download branch from dfd2fe8 to 0a3c167 Compare July 2, 2026 13:59
@eboudrant eboudrant merged commit e83ff0d into main Jul 2, 2026
7 checks passed
@eboudrant eboudrant deleted the fix/abort-scan-from-url-download branch July 2, 2026 14:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[P1] Cancelling scan-from-url doesn't abort the in-flight download; no size cap

2 participants