[High] Code execution TimeoutSeconds not enforced on worker #59

New Issue

2026-05-05T04:15:23Z

spikerj commented

2026-05-05 04:15:23 +00:00

Severity: High (resource safety)

File: SpikerSoft.EventHandlers.CodeExecution/Services/CodeExecutionWorkerHostedService.cs (~298)

Problem: worker.ExecuteCodeAsync(request) is called without any CancellationToken linked to request.TimeoutSeconds. Roslyn's ExecuteFreePlayAsync only checks cancellation at the start, not around emit/invoke. If student code hangs (infinite loop, blocking I/O), nothing kills it.

Fix:

using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(request.TimeoutSeconds));
using var linkedCts = CancellationTokenSource.CreateLinkedTokenSource(cts.Token, stoppingToken);
var response = await worker.ExecuteCodeAsync(request, linkedCts.Token);

Also ensure RoslynCodeExecutor checks the token periodically inside execution.

Acceptance criteria:

Infinite-loop student code is killed within TimeoutSeconds + small buffer
Test with while(true){} confirms cancellation
No regression for legitimate quick executions

**Severity:** High (resource safety) **File:** `SpikerSoft.EventHandlers.CodeExecution/Services/CodeExecutionWorkerHostedService.cs` (~298) **Problem:** `worker.ExecuteCodeAsync(request)` is called without any `CancellationToken` linked to `request.TimeoutSeconds`. Roslyn's `ExecuteFreePlayAsync` only checks cancellation at the start, not around emit/invoke. If student code hangs (infinite loop, blocking I/O), nothing kills it. **Fix:** ```csharp using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(request.TimeoutSeconds)); using var linkedCts = CancellationTokenSource.CreateLinkedTokenSource(cts.Token, stoppingToken); var response = await worker.ExecuteCodeAsync(request, linkedCts.Token); ``` Also ensure `RoslynCodeExecutor` checks the token periodically inside execution. **Acceptance criteria:** - [ ] Infinite-loop student code is killed within `TimeoutSeconds + small buffer` - [ ] Test with `while(true){}` confirms cancellation - [ ] No regression for legitimate quick executions

spikerj commented

2026-05-05 04:46:20 +00:00

Resolved.

CodeExecutionWorkerHostedService now enforces request.TimeoutSeconds per message:

Captured stoppingToken into _shutdownToken field at ExecuteAsync start
In OnCodeExecutionRequestReceived, builds a CancellationTokenSource(timeout) linked with _shutdownToken
request.TimeoutSeconds is clamped to [1, 300] via MaxExecutionTimeout = 5 minutes to bound worst-case worker load even if a misconfigured client claims an enormous timeout
worker.ExecuteCodeAsync(request, linkedCts.Token) now receives the linked token
OperationCanceledException from a tripped timeout is caught and turned into a CodeExecutionResponse with Success = false and a clear error message

File: SpikerSoft.EventHandlers.CodeExecution/Services/CodeExecutionWorkerHostedService.cs.

**Resolved.** `CodeExecutionWorkerHostedService` now enforces `request.TimeoutSeconds` per message: - Captured `stoppingToken` into `_shutdownToken` field at `ExecuteAsync` start - In `OnCodeExecutionRequestReceived`, builds a `CancellationTokenSource(timeout)` linked with `_shutdownToken` - `request.TimeoutSeconds` is clamped to `[1, 300]` via `MaxExecutionTimeout = 5 minutes` to bound worst-case worker load even if a misconfigured client claims an enormous timeout - `worker.ExecuteCodeAsync(request, linkedCts.Token)` now receives the linked token - `OperationCanceledException` from a tripped timeout is caught and turned into a `CodeExecutionResponse` with `Success = false` and a clear error message File: `SpikerSoft.EventHandlers.CodeExecution/Services/CodeExecutionWorkerHostedService.cs`.

spikerj closed this issue

2026-05-05 04:51:57 +00:00

spikerj referenced this issue

2026-06-15 20:11:46 +00:00

Refactor: extract synthetic-file binding (.prettierrc) out of LanguageRunner into a dedicated helper #82

spikerj referenced this issue

2026-07-03 19:51:51 +00:00

[Bug] /api/system/version rate limiter rejects with 503 instead of 429 (RejectionStatusCode default) #341

spikerj referenced this issue

2026-07-03 20:03:37 +00:00

[Epic] Full-coverage Playwright E2E walk of the Angular app with live Jaeger + Seq telemetry #307

spikerj referenced this issue