Bug: generate_pdf_from_saved_event lacks job registry guard allowing unlimited concurrent PDF generation

[techmore]

Type

bug

Severity

medium

Area

nmapui/handlers/scan_jobs.py — generate_pdf_from_saved_event

Description

The generate_pdf_from_saved_event handler directly calls socketio.start_background_task() without first checking job_registry.start() to prevent concurrent report jobs. Unlike generate_report_event which properly guards with the job registry, this handler can start unlimited concurrent PDF generation tasks.

A client could trigger many simultaneous Playwright/wkhtmltopdf processes consuming CPU, memory, and disk I/O without limit.

Proposed Fix

Add a job registry guard before spawning the background task, matching the pattern used in generate_report_event:

@socketio.on("generate_pdf_from_saved")
@require_socket_auth()
def generate_pdf_from_saved_event(data):
    if not job_registry.start(request.sid, "report", {...}):
        emit_to_client(request.sid, "report_error", {"error": "A report job is already running"})
        return
    socketio.start_background_task(generate_pdf_from_saved_task, request.sid, data)

Related Issues

#166 (Reporting module modularization)