fix(cua-driver/windows): reject stale element-cache snapshots - #2075
fix(cua-driver/windows): reject stale element-cache snapshots#2075outdog-hwh wants to merge 2 commits into
Conversation
|
@outdog-hwh is attempting to deploy a commit to the Cua Team on Vercel. A member of the Team first needs to authorize it. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthrough
ChangesWindows element-cache staleness and error harmonization
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@libs/cua-driver/rust/crates/platform-windows/src/uia/cache.rs`:
- Around line 96-100: In snapshot_is_stale, the fallback currently returns false
when current_window_rect is unavailable, which lets cached coordinates be
treated as fresh even after GetWindowRect fails. Update the staleness check to
fail closed: if CachedSnapshot.window_rect has a value but the live window rect
cannot be read, treat the snapshot as stale instead of fresh. Use
snapshot_is_stale and the current_window_rect handling as the focal points for
the fix.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: cae4987f-2110-45a5-9db2-e14419a99854
📒 Files selected for processing (2)
libs/cua-driver/rust/crates/platform-windows/src/tools/impl_.rslibs/cua-driver/rust/crates/platform-windows/src/uia/cache.rs
| fn snapshot_is_stale(snapshot: &CachedSnapshot, current_window_rect: Option<WindowRect>) -> bool { | ||
| match (snapshot.window_rect, current_window_rect) { | ||
| (Some(cached), Some(current)) => cached != current, | ||
| _ => false, | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Fail closed when the live window rect cannot be read.
When a snapshot has a cached rect but GetWindowRect now fails, this returns false and allows cached screen coordinates to be reused even though freshness could not be established.
Proposed fix
fn snapshot_is_stale(snapshot: &CachedSnapshot, current_window_rect: Option<WindowRect>) -> bool {
match (snapshot.window_rect, current_window_rect) {
(Some(cached), Some(current)) => cached != current,
+ (Some(_), None) => true,
_ => false,
}
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| fn snapshot_is_stale(snapshot: &CachedSnapshot, current_window_rect: Option<WindowRect>) -> bool { | |
| match (snapshot.window_rect, current_window_rect) { | |
| (Some(cached), Some(current)) => cached != current, | |
| _ => false, | |
| } | |
| fn snapshot_is_stale(snapshot: &CachedSnapshot, current_window_rect: Option<WindowRect>) -> bool { | |
| match (snapshot.window_rect, current_window_rect) { | |
| (Some(cached), Some(current)) => cached != current, | |
| (Some(_), None) => true, | |
| _ => false, | |
| } | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@libs/cua-driver/rust/crates/platform-windows/src/uia/cache.rs` around lines
96 - 100, In snapshot_is_stale, the fallback currently returns false when
current_window_rect is unavailable, which lets cached coordinates be treated as
fresh even after GetWindowRect fails. Update the staleness check to fail closed:
if CachedSnapshot.window_rect has a value but the live window rect cannot be
read, treat the snapshot as stale instead of fresh. Use snapshot_is_stale and
the current_window_rect handling as the focal points for the fix.
|
This is a genuinely-missing fix — the pre-click freshness guard from #1984 (stale cached center after a window move) is not on main; 0.7.0's cache work was the UAF fix (RetainedElement), a different problem. The logic looks sound. Two things before it can land: (1) it's conflicting against 0.7.0 — please rebase onto the |
bfb8188 to
1d4d469
Compare
|
Thanks for the review. I rebased this onto current What changed in this update:
Validation run on Windows:
The PR is now mergeable from GitHub's view. The remaining Vercel failure still appears to be the existing authorization/deploy permission issue, not a code check failure. |
3 participants
What changed
This adds a freshness guard to the Windows UIA/MSAA element cache so cached element centers and rects are no longer reused after the target window moves or resizes.
Instead of silently dispatching a click with stale screen coordinates, click-family tools now fail fast with a stale snapshot error and ask the caller to rerun
get_window_state.Related issue
Fixes #1984
Approach
GetWindowRectno longer matches the captured rect.click,double_click, andright_clickinstead of the old generic cache-miss message.Testing
cargo test -p platform-windowsNotes
This is the smaller fail-fast variant discussed in #1984. It does not try to auto-refresh the snapshot or hook window-move events yet.
Summary by CodeRabbit
New Features
Bug Fixes