fix(drivers/139): Address login logic loop defect by UcnacDx2 · Pull Request #1974 · OpenListTeam/OpenList

UcnacDx2 · 2026-01-14T12:58:08Z

Description / 描述

有用户报告称，遇到登陆问题，返回错误信息如下：
Failed init storage: login with password failed: failed to extract sid or cguid from login response

经查，目前 139 云盘驱动在处理初始化登录时存在逻辑闭环缺陷：

重复登录触发风控： 驱动在已有有效 a_l/a_l2 令牌的情况下，仍会尝试执行 password_login（密码登录），导致短时间内频繁错误请求请求移动登录接口，触发 ec=PML401010062（频率限制/风控）错误。
非法状态请求： 在请求登录接口（Login.ashx）时，如果 Header 携带了旧的 a_l/a_l2 令牌等，会触发服务器的安全保护机制，导致重定向链接中缺失 sid 参数。

Motivation and Context / 背景

Relates to #XXXX

How Has This Been Tested? / 测试

填入如下不同状态189mail cookie
①未进行设备认证
②已经进行设备认证，且处于登录状态
③已经进行设备认证，且处于注销状态

Checklist / 检查清单

I have read the CONTRIBUTING document.
我已阅读 CONTRIBUTING 文档。
I have formatted my code with go fmt or prettier.
我已使用 go fmt 或 prettier 格式化提交的代码。
I have added appropriate labels to this PR (or mentioned needed labels in the description if lacking permissions).
我已为此 PR 添加了适当的标签（如无权限或需要的标签不存在，请在描述中说明，管理员将后续处理）。
I have requested review from relevant code authors using the "Request review" feature when applicable.
我已在适当情况下使用"Request review"功能请求相关代码作者进行审查。
I have updated the repository accordingly (If it’s needed).
我已相应更新了相关仓库（若适用）。
- OpenList-Frontend #XXXX
- OpenList-Docs #XXXX

- Implemented a pre-auth validation check to prevent unnecessary logins when a valid session token exists. - Enhanced header sanitization to separate device fingerprint from session tokens, preventing login failures. - Added risk control handling to detect and stop login attempts when rate-limited.

fix(139yun): Address login logic loop defect

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

- Implemented a pre-auth validation check to prevent unnecessary logins when a valid session token exists. - Enhanced header sanitization to separate device fingerprint from session tokens, preventing login failures. - Added risk control handling to detect and stop login attempts when rate-limited. - Ensured a fixed order for sanitized cookies as per PR feedback.

- Implemented a pre-auth validation check to prevent unnecessary logins when a valid session token exists. - Enhanced header sanitization to separate device fingerprint from session tokens, preventing login failures. - Added risk control handling to detect and stop login attempts when rate-limited. - Ensured a fixed order for sanitized cookies as per PR feedback. - Improved pre-auth error handling to correctly differentiate between network errors and blocked redirects.

- Implemented a pre-auth validation check to prevent unnecessary logins when a valid session token exists. - Enhanced header sanitization to separate device fingerprint from session tokens, preventing login failures. - Added risk control handling to detect and stop login attempts when rate-limited. - Ensured a fixed order for sanitized cookies as per PR feedback. - Improved pre-auth error handling to correctly differentiate between network errors and blocked redirects. - Formatted code with `go fmt`.

- Implemented a pre-auth validation check to prevent unnecessary logins when a valid session token exists. - Enhanced header sanitization to separate device fingerprint from session tokens, preventing login failures. - Added risk control handling to detect and stop login attempts when rate-limited. - Ensured a fixed order for sanitized cookies as per PR feedback. - Improved pre-auth error handling to correctly differentiate between network errors and blocked redirects. - Formatted code with `go fmt`. - Added validation for MailCookies format to prevent invalid requests.

- Implemented a pre-auth validation check to prevent unnecessary logins when a valid session token exists. - Enhanced header sanitization to separate device fingerprint from session tokens, preventing login failures. - Added risk control handling to detect and stop login attempts when rate-limited. - Ensured a fixed order for sanitized cookies as per PR feedback. - Improved pre-auth error handling to correctly differentiate between network errors and blocked redirects. - Formatted code with `go fmt`. - Added validation for MailCookies format to prevent invalid requests. - Refactored the `request` function to remove goto and reduce nesting.

Fix 139 yun login loop

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 10 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

drivers/139/util.go

drivers/139/driver.go

drivers/139/util.go

This commit addresses several issues in the 139 driver, including: - A concurrency issue in preAuthLogin by creating a new resty client instance. - Removal of sensitive data from logs to prevent credential exposure. - Improved MailCookies validation to ensure it contains at least one name=value pair. - Corrected an inaccurate error message for better accuracy. - Clarified the sanitizeLoginCookies function with a comment. - Standardized error handling in preAuthLogin to allow a fallback to password login. - Fixed a mixed-language comment for consistency. - Strengthened a fragile error check by examining the underlying error type.

This commit addresses a concurrency issue that occurred when creating multiple instances of the 139 driver. The issue was caused by modifying the global `resty` client's redirect policy, which is not thread-safe. This commit fixes the issue by: - Creating a new `resty` client instance in `step1_password_login` to avoid modifying the global client. - Reverting a previous change to the error handling in `preAuthLogin` that was incorrect. These changes ensure that each driver instance has its own `resty` client, preventing race conditions and allowing multiple instances of the driver to be created without errors.

This commit fixes a regression where the `RMKEY` cookie was not being correctly extracted from the login response. This was caused by a previous change that switched to a local `resty` client but did not update the cookie extraction logic. This commit fixes the issue by: - Correctly parsing the cookies from the HTTP response. - Merging the new cookies with the existing `MailCookies`. This ensures that the `RMKEY` is properly saved and used in subsequent steps, allowing the login process to complete successfully.

fix(drivers/139): Address multiple issues in 139 driver

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

drivers/139/util.go

drivers/139/driver.go

drivers/139/util.go

Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

…sent Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

… Password) Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

…nd enforce password validation Optimize 139 driver login flow - eliminate unnecessary HTTP request and enforce password validation

jyxjjj · 2026-01-19T16:41:19Z

可以用AI，但不至于这么重度吧

UcnacDx2 · 2026-01-20T15:42:11Z

可以用AI，但不至于这么重度吧

报一丝（）
加了点防呆，用来减少用户基数加上错误请求带来的风控，给ai写了
我自用的话简单改改前面几版够我用了
能合吗

UcnacDx2 · 2026-02-01T14:56:04Z

可以用AI，但不至于这么重度吧

我清理并重构了一下代码，大佬能再帮看看吗

jyxjjj · 2026-02-01T15:05:50Z

但也不用着急关吧还需要团队成员看我一直都只是第一道而已看你自己意愿哈关不关都没事的 PR有就是好事

UcnacDx2 · 2026-02-01T15:09:44Z

但也不用着急关吧还需要团队成员看我一直都只是第一道而已看你自己意愿哈关不关都没事的 PR有就是好事

不太熟悉流程，抱歉

jyxjjj · 2026-02-01T15:14:09Z

Closed via Updates on #2067

google-labs-jules bot and others added 2 commits January 14, 2026 12:15

fix(139yun): Address login logic loop defect

06cb122

fix(139yun): Address login logic loop defect

Copilot AI review requested due to automatic review settings January 14, 2026 12:58

Copilot started reviewing on behalf of UcnacDx2 January 14, 2026 12:58 View session

Copilot AI reviewed Jan 14, 2026

View reviewed changes

google-labs-jules bot and others added 7 commits January 14, 2026 13:27

Fix 139 yun login loop

6c1805c

Fix 139 yun login loop

UcnacDx2 requested a review from Copilot January 14, 2026 14:07

Copilot started reviewing on behalf of UcnacDx2 January 14, 2026 14:08 View session

Copilot AI reviewed Jan 14, 2026

View reviewed changes

google-labs-jules bot and others added 4 commits January 14, 2026 14:32

fix(drivers/139): Address multiple issues in 139 driver

a104620

fix(drivers/139): Address multiple issues in 139 driver

UcnacDx2 requested a review from Copilot January 14, 2026 15:08

Copilot started reviewing on behalf of UcnacDx2 January 14, 2026 15:09 View session

Copilot AI reviewed Jan 14, 2026

View reviewed changes

Copilot AI and others added 8 commits January 14, 2026 16:17

Initial plan

beb2915

Optimize 139 driver login flow - check step2 params first, simplify code

b870bea

Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

Fix syntax errors in 139 driver optimizations

ab40f16

Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

Address code review feedback - remove unused variable and fix log level

607d4c7

Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

Improve code comments for accuracy and clarity

403ee26

Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

Final improvements - trim sid value and clarify comment

3217aed

Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

Add RMKEY check and clarify comment about op.MustSaveDriverStorage

f5675d9

Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

Add early termination for cookie loop performance optimization

ffda3f1

Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

Copilot AI and others added 4 commits January 14, 2026 16:38

Fix: Always require password login when all three credentials are pre…

337b45f

…sent Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

Add all-or-nothing validation for credentials (MailCookies, Username,…

5ee3721

… Password) Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

Simplify all-or-nothing credential validation logic

7050f6a

Co-authored-by: UcnacDx2 <127503808+UcnacDx2@users.noreply.github.com>

Optimize 139 driver login flow - eliminate unnecessary HTTP request a…

da68b63

…nd enforce password validation Optimize 139 driver login flow - eliminate unnecessary HTTP request and enforce password validation

xrgzs changed the title ~~fix(139yun): Address login logic loop defect~~ fix(drivers/139): Address login logic loop defect Jan 15, 2026

xrgzs added bug Module: Driver Driver-Related Issue/PR labels Jan 15, 2026

UcnacDx2 added 2 commits January 16, 2026 12:12

Merge branch 'main' into main

205e1d6

Merge branch 'main' into main

8985f0b

UcnacDx2 closed this Feb 1, 2026

Uh oh!

Conversation

UcnacDx2 commented Jan 14, 2026 • edited by xrgzs Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description / 描述

Motivation and Context / 背景

How Has This Been Tested? / 测试

Checklist / 检查清单

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jyxjjj commented Jan 19, 2026

Uh oh!

UcnacDx2 commented Jan 20, 2026

Uh oh!

UcnacDx2 commented Feb 1, 2026

Uh oh!

jyxjjj commented Feb 1, 2026

Uh oh!

UcnacDx2 commented Feb 1, 2026

Uh oh!

jyxjjj commented Feb 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

UcnacDx2 commented Jan 14, 2026 •

edited by xrgzs

Loading