andresriancho / w3af

w3af: web application attack and audit framework, the open source web vulnerability scanner.
http://w3af.org/
4.57k stars 1.22k forks source link

Restful API - Scan stopping does not clean up completely #16059

Open linerd0196 opened 7 years ago

linerd0196 commented 7 years ago

After each scan is stopped, cleaned up, then started again, there will be one more active w3afCore object remaining. These object's worker_pool are active, every one of them creates 20 threads, and never be joined.

There are too ways I think that can solve this problem:

linerd0196 commented 7 years ago

This w3afCore shouldn't create threads. Here is how it does


  File "/usr/local/src/sec/w3af-latest/w3af/core/ui/api/resources/scans.py", line 81, in start_scan
    workdir=profile_path)
  File "/usr/local/src/sec/w3af-latest/w3af/core/controllers/core_helpers/profiles.py", line 223, in use_profile
    plugin_options)
  File "/usr/local/src/sec/w3af-latest/w3af/core/controllers/core_helpers/plugins.py", line 127, in set_plugin_options
    plugin_inst = self.get_plugin_inst(plugin_type, plugin_name)
  File "/usr/local/src/sec/w3af-latest/w3af/core/controllers/core_helpers/plugins.py", line 269, in get_plugin_inst
    plugin_inst.set_worker_pool(self._w3af_core.worker_pool)
  File "/usr/local/src/sec/w3af-latest/w3af/core/controllers/w3afCore.py", line 289, in worker_pool
    max_queued_tasks=self.WORKER_THREADS * 10)```