patched thread leaks

Author: Earth1283

pymcl/config_manager.py

@@ -1,5 +1,6 @@
 import json
 import os
+import threading
 from pathlib import Path
 
 # Determine default data directory (mirrors constants.py logic to avoid circular import)
@@ -19,10 +20,12 @@
 
 class ConfigManager:
     _instance = None
+    _lock = threading.Lock()
 
     def __new__(cls):
         if cls._instance is None:
             cls._instance = super(ConfigManager, cls).__new__(cls)
+            cls._instance._rw_lock = threading.Lock()
             cls._instance._load_config()
         return cls._instance
 
@@ -36,18 +39,22 @@ def _load_config(self):
                 print(f"Error loading settings: {e}")
 
     def get(self, key, default=None):
-        return self._settings.get(key, default)
+        with self._rw_lock:
+            return self._settings.get(key, default)
 
     def set(self, key, value):
-        self._settings[key] = value
+        with self._rw_lock:
+            self._settings[key] = value
 
     def save(self):
-        CONFIG_DIR.mkdir(parents=True, exist_ok=True)
-        try:
-            with open(SETTINGS_FILE, "w") as f:
-                json.dump(self._settings, f, indent=4)
-        except OSError as e:
-            print(f"Error saving settings: {e}")
+        with self._rw_lock:
+            CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+            try:
+                with open(SETTINGS_FILE, "w") as f:
+                    json.dump(self._settings, f, indent=4)
+            except OSError as e:
+                print(f"Error saving settings: {e}")
 
     def get_all(self):
-        return self._settings.copy()
+        with self._rw_lock:
+            return self._settings.copy()

pymcl/constants.py

@@ -1,4 +1,5 @@
 import os
+from pathlib import Path
 from typing import TypedDict
 from .config_manager import ConfigManager
 
@@ -23,11 +24,13 @@
 
 def get_game_dir(version_id: str) -> str:
     """Returns the game directory for a specific version instance."""
-    # sanitize version_id to avoid path traversal or invalid characters if necessary
-    # For now, we assume version_id is safe as it comes from the launcher lib
     if not version_id or version_id == "Loading versions...":
-        return MINECRAFT_DIR # Fallback to default
-    return os.path.join(MINECRAFT_DIR, "instances", version_id)
+        return MINECRAFT_DIR
+    base = Path(MINECRAFT_DIR) / "instances"
+    result = (base / version_id).resolve()
+    if not str(result).startswith(str(base.resolve())):
+        raise ValueError(f"Invalid version_id: {version_id!r}")
+    return str(result)
 
 
 def get_mods_dir(version_id: str) -> str:

pymcl/image_cache.py

@@ -32,7 +32,6 @@ class ImageCache(QObject):
 
     def __init__(self, parent=None):
         super().__init__(parent)
-        self.downloader_threads = []
 
     def get_image(self, url):
         filename = url.split("/")[-1]
@@ -45,7 +44,7 @@ def get_image(self, url):
             return None
 
     def download_image(self, url, cache_path):
-        thread = QThread()
+        thread = QThread(self)  # parent=self keeps it alive until finished
         downloader = ImageDownloader(url, cache_path)
         downloader.moveToThread(thread)
 
@@ -57,7 +56,6 @@ def download_image(self, url, cache_path):
         thread.finished.connect(thread.deleteLater)
 
         thread.start()
-        self.downloader_threads.append(thread)
 
     @pyqtSlot(str, str)
     def on_image_downloaded(self, url, path):

pymcl/microsoft_auth.py

@@ -44,7 +44,17 @@ def start_login(self):
 
         self.server_thread = QThread()
         self.http_server = HTTPServer(("localhost", 8000), lambda *args, **kwargs: AuthHandler(self.finish_login, *args, **kwargs))
-        self.server_thread.run = self.http_server.handle_request
+        self.http_server.socket.settimeout(120)  # unblock after 2 minutes if auth never completes
+
+        def run_server():
+            try:
+                self.http_server.handle_request()
+            except OSError:
+                self.login_failed.emit("Login timed out or was cancelled.")
+                if self.http_server:
+                    self.http_server.server_close()
+
+        self.server_thread.run = run_server
         self.server_thread.start()
 
     def finish_login(self, auth_code):

pymcl/skin_manager.py

@@ -80,7 +80,7 @@ def run(self):
             else:
                 try:
                     err = resp.json().get("errorMessage", resp.text)
-                except:
+                except (ValueError, KeyError):
                     err = resp.text
                 self.finished.emit(False, f"Upload failed: {err}")