fix(drivers/139): Address login logic loop defect #1974

UcnacDx2 · 2026-01-14T12:58:08Z

Description / 描述

有用户报告称，遇到登陆问题，返回错误信息如下：
Failed init storage: login with password failed: failed to extract sid or cguid from login response

经查，目前 139 云盘驱动在处理初始化登录时存在逻辑闭环缺陷：

重复登录触发风控： 驱动在已有有效 a_l/a_l2 令牌的情况下，仍会尝试执行 password_login（密码登录），导致短时间内频繁错误请求请求移动登录接口，触发 ec=PML401010062（频率限制/风控）错误。
非法状态请求： 在请求登录接口（Login.ashx）时，如果 Header 携带了旧的 a_l/a_l2 令牌等，会触发服务器的安全保护机制，导致重定向链接中缺失 sid 参数。

Motivation and Context / 背景

Relates to #XXXX

How Has This Been Tested? / 测试

填入如下不同状态189mail cookie
①未进行设备认证
②已经进行设备认证，且处于登录状态
③已经进行设备认证，且处于注销状态

Checklist / 检查清单

I have read the CONTRIBUTING document.
我已阅读 CONTRIBUTING 文档。
I have formatted my code with go fmt or prettier.
我已使用 go fmt 或 prettier 格式化提交的代码。
I have added appropriate labels to this PR (or mentioned needed labels in the description if lacking permissions).
我已为此 PR 添加了适当的标签（如无权限或需要的标签不存在，请在描述中说明，管理员将后续处理）。
I have requested review from relevant code authors using the "Request review" feature when applicable.
我已在适当情况下使用"Request review"功能请求相关代码作者进行审查。
I have updated the repository accordingly (If it’s needed).
我已相应更新了相关仓库（若适用）。
- OpenList-Frontend #XXXX
- OpenList-Docs #XXXX

- Implemented a pre-auth validation check to prevent unnecessary logins when a valid session token exists. - Enhanced header sanitization to separate device fingerprint from session tokens, preventing login failures. - Added risk control handling to detect and stop login attempts when rate-limited.

fix(139yun): Address login logic loop defect

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

- Implemented a pre-auth validation check to prevent unnecessary logins when a valid session token exists. - Enhanced header sanitization to separate device fingerprint from session tokens, preventing login failures. - Added risk control handling to detect and stop login attempts when rate-limited. - Ensured a fixed order for sanitized cookies as per PR feedback.

- Implemented a pre-auth validation check to prevent unnecessary logins when a valid session token exists. - Enhanced header sanitization to separate device fingerprint from session tokens, preventing login failures. - Added risk control handling to detect and stop login attempts when rate-limited. - Ensured a fixed order for sanitized cookies as per PR feedback. - Improved pre-auth error handling to correctly differentiate between network errors and blocked redirects.

- Implemented a pre-auth validation check to prevent unnecessary logins when a valid session token exists. - Enhanced header sanitization to separate device fingerprint from session tokens, preventing login failures. - Added risk control handling to detect and stop login attempts when rate-limited. - Ensured a fixed order for sanitized cookies as per PR feedback. - Improved pre-auth error handling to correctly differentiate between network errors and blocked redirects. - Formatted code with `go fmt`.

- Implemented a pre-auth validation check to prevent unnecessary logins when a valid session token exists. - Enhanced header sanitization to separate device fingerprint from session tokens, preventing login failures. - Added risk control handling to detect and stop login attempts when rate-limited. - Ensured a fixed order for sanitized cookies as per PR feedback. - Improved pre-auth error handling to correctly differentiate between network errors and blocked redirects. - Formatted code with `go fmt`. - Added validation for MailCookies format to prevent invalid requests.

- Implemented a pre-auth validation check to prevent unnecessary logins when a valid session token exists. - Enhanced header sanitization to separate device fingerprint from session tokens, preventing login failures. - Added risk control handling to detect and stop login attempts when rate-limited. - Ensured a fixed order for sanitized cookies as per PR feedback. - Improved pre-auth error handling to correctly differentiate between network errors and blocked redirects. - Formatted code with `go fmt`. - Added validation for MailCookies format to prevent invalid requests. - Refactored the `request` function to remove goto and reduce nesting.

Fix 139 yun login loop

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 10 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

drivers/139/util.go

drivers/139/driver.go

drivers/139/util.go

This commit addresses several issues in the 139 driver, including: - A concurrency issue in preAuthLogin by creating a new resty client instance. - Removal of sensitive data from logs to prevent credential exposure. - Improved MailCookies validation to ensure it contains at least one name=value pair. - Corrected an inaccurate error message for better accuracy. - Clarified the sanitizeLoginCookies function with a comment. - Standardized error handling in preAuthLogin to allow a fallback to password login. - Fixed a mixed-language comment for consistency. - Strengthened a fragile error check by examining the underlying error type.

This commit addresses a concurrency issue that occurred when creating multiple instances of the 139 driver. The issue was caused by modifying the global `resty` client's redirect policy, which is not thread-safe. This commit fixes the issue by: - Creating a new `resty` client instance in `step1_password_login` to avoid modifying the global client. - Reverting a previous change to the error handling in `preAuthLogin` that was incorrect. These changes ensure that each driver instance has its own `resty` client, preventing race conditions and allowing multiple instances of the driver to be created without errors.

This commit fixes a regression where the `RMKEY` cookie was not being correctly extracted from the login response. This was caused by a previous change that switched to a local `resty` client but did not update the cookie extraction logic. This commit fixes the issue by: - Correctly parsing the cookies from the HTTP response. - Merging the new cookies with the existing `MailCookies`. This ensures that the `RMKEY` is properly saved and used in subsequent steps, allowing the login process to complete successfully.

fix(drivers/139): Address multiple issues in 139 driver

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

drivers/139/util.go

Copilot · 2026-01-14T15:12:11Z

drivers/139/util.go

+	orderedCookieNames := []string{
+		"behaviorid",
+		"Os_SSo_Sid",
+		"_139_index_isLoginType",
+		"_139_login_version",
+		"Login_UserNumber",
+		"cookiepartid8011",
+		"_139_login_agreement",
+		"UserData",
+		"rmUin8011",
+		"cookiepartid",
+		"UUIDToken",
+		"SkinPath28011",
+		"cbauto",
+		"areaCode8011",
+		"cookieLen",
+		"DEVICE_INFO_DIGEST",
+		"JSESSIONID",
+		"loginProcessFlag",
+		"provCode8011",
+		"S_DEVICE_TOKEN",
+		"taskIdCloud",
+		"UserNowState",
+		"UserNowState8011",
+		"ut8011",
+	}


The sanitizeLoginCookies function doesn't filter out authentication tokens like "a_l" and "a_l2" from the allowlist. According to the PR description, the problem is that carrying old a_l/a_l2 tokens in the login request triggers security protection. However, these tokens are not in the orderedCookieNames list, so they won't be included in the sanitized output. This appears to be working as intended, but it would be helpful to add a comment explaining that authentication tokens are intentionally excluded to prevent triggering security controls.

drivers/139/util.go

drivers/139/driver.go

Copilot · 2026-01-14T15:12:13Z

drivers/139/util.go

+		}
+	}
+
+	if resp.StatusCode() == 302 {


There is a potential nil pointer dereference issue. If the request at line 1331 fails with a non-redirect error, the response object resp might be nil when checking resp.StatusCode() at line 1343. The code should verify that resp is not nil before accessing its methods.

Co-authored-by: UcnacDx2 <[email protected]>

…sent Co-authored-by: UcnacDx2 <[email protected]>

… Password) Co-authored-by: UcnacDx2 <[email protected]>

Co-authored-by: UcnacDx2 <[email protected]>

…nd enforce password validation Optimize 139 driver login flow - eliminate unnecessary HTTP request and enforce password validation

google-labs-jules bot and others added 2 commits January 14, 2026 12:15

fix(139yun): Address login logic loop defect

06cb122

fix(139yun): Address login logic loop defect

Copilot AI review requested due to automatic review settings January 14, 2026 12:58

Copilot started reviewing on behalf of UcnacDx2 January 14, 2026 12:58 View session

Copilot AI reviewed Jan 14, 2026

View reviewed changes

google-labs-jules bot and others added 7 commits January 14, 2026 13:27

Fix 139 yun login loop

6c1805c

Fix 139 yun login loop

UcnacDx2 requested a review from Copilot January 14, 2026 14:07

Copilot started reviewing on behalf of UcnacDx2 January 14, 2026 14:08 View session

Copilot AI reviewed Jan 14, 2026

View reviewed changes

google-labs-jules bot and others added 4 commits January 14, 2026 14:32

fix(drivers/139): Address multiple issues in 139 driver

a104620

fix(drivers/139): Address multiple issues in 139 driver

UcnacDx2 requested a review from Copilot January 14, 2026 15:08

Copilot started reviewing on behalf of UcnacDx2 January 14, 2026 15:09 View session

Copilot AI reviewed Jan 14, 2026

View reviewed changes

Copilot AI and others added 8 commits January 14, 2026 16:17

Initial plan

beb2915

Optimize 139 driver login flow - check step2 params first, simplify code

b870bea

Co-authored-by: UcnacDx2 <[email protected]>

Fix syntax errors in 139 driver optimizations

ab40f16

Co-authored-by: UcnacDx2 <[email protected]>

Address code review feedback - remove unused variable and fix log level

607d4c7

Co-authored-by: UcnacDx2 <[email protected]>

Improve code comments for accuracy and clarity

403ee26

Co-authored-by: UcnacDx2 <[email protected]>

Final improvements - trim sid value and clarify comment

3217aed

Co-authored-by: UcnacDx2 <[email protected]>

Add RMKEY check and clarify comment about op.MustSaveDriverStorage

f5675d9

Co-authored-by: UcnacDx2 <[email protected]>

Add early termination for cookie loop performance optimization

ffda3f1

Co-authored-by: UcnacDx2 <[email protected]>

Copilot AI and others added 4 commits January 14, 2026 16:38

Fix: Always require password login when all three credentials are pre…

337b45f

…sent Co-authored-by: UcnacDx2 <[email protected]>

Add all-or-nothing validation for credentials (MailCookies, Username,…

5ee3721

… Password) Co-authored-by: UcnacDx2 <[email protected]>

Simplify all-or-nothing credential validation logic

7050f6a

Co-authored-by: UcnacDx2 <[email protected]>

Optimize 139 driver login flow - eliminate unnecessary HTTP request a…

da68b63

…nd enforce password validation Optimize 139 driver login flow - eliminate unnecessary HTTP request and enforce password validation

xrgzs changed the title ~~fix(139yun): Address login logic loop defect~~ fix(drivers/139): Address login logic loop defect Jan 15, 2026

xrgzs added bug Module: Driver Driver-Related Issue/PR labels Jan 15, 2026

Merge branch 'main' into main

205e1d6

Uh oh!

fix(drivers/139): Address login logic loop defect #1974

Are you sure you want to change the base?

fix(drivers/139): Address login logic loop defect #1974

Uh oh!

Conversation

UcnacDx2 commented Jan 14, 2026 • edited by xrgzs Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description / 描述

Motivation and Context / 背景

How Has This Been Tested? / 测试

Checklist / 检查清单

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

UcnacDx2 commented Jan 14, 2026 •

edited by xrgzs

Loading