Problem
POST /api/stop manually coerces the JSON body's all field with bool(body["all"]). In Python, every non-empty string is truthy, so a client sending {"all":"false","session_id":"session-1"} invokes stop_tasks(clear_all=True, ...).
This can terminate every active task even though the caller explicitly supplied false and targeted one session.
Reproduction
- Send
POST /api/stop with JSON body {"all":"false","session_id":"session-1"}.
- Observe that
TaskQueueService.stop_tasks receives clear_all=True.
The same issue affects other non-empty false-like values such as "0", "no", and "off".
Expected behavior
Recognized false-like values must not enable global cancellation. Unrecognized values should be rejected before any stop operation runs. Query-string all=true should retain precedence when explicitly supplied.
Proposed fix
Normalize boolean body values explicitly and add router-level regression tests for false-like, true-like, and invalid values.
Problem
POST /api/stopmanually coerces the JSON body'sallfield withbool(body["all"]). In Python, every non-empty string is truthy, so a client sending{"all":"false","session_id":"session-1"}invokesstop_tasks(clear_all=True, ...).This can terminate every active task even though the caller explicitly supplied
falseand targeted one session.Reproduction
POST /api/stopwith JSON body{"all":"false","session_id":"session-1"}.TaskQueueService.stop_tasksreceivesclear_all=True.The same issue affects other non-empty false-like values such as
"0","no", and"off".Expected behavior
Recognized false-like values must not enable global cancellation. Unrecognized values should be rejected before any stop operation runs. Query-string
all=trueshould retain precedence when explicitly supplied.Proposed fix
Normalize boolean body values explicitly and add router-level regression tests for false-like, true-like, and invalid values.