fix(ci): cap dependency guard error bodies · openclaw/ope...

Recent Commits to openclaw:main

vincentkoc · 2026-05-30 · via Recent Commits to openclaw:main

Original file line number	Diff line number	Diff line change
`@@ -6,6 +6,7 @@ export const dependencyChangeMarker = "<!-- openclaw:dependency-guard -->";`
`6`	`6`	`export const dependencyGraphGuardMarker = "<!-- openclaw:dependency-graph-guard -->";`
`7`	`7`	`export const dependencyChangedLabel = "dependencies-changed";`
`8`	`8`	`export const allowDependenciesCommand = "/allow-dependencies-change";`
	`9`	`+export const GITHUB_ERROR_BODY_MAX_BYTES = 64 * 1024;`
`9`	`10`
`10`	`11`	`const maxListedFiles = 25;`
`11`	`12`	`const securityTeamSlug = process.env.OPENCLAW_SECURITY_TEAM_SLUG ?? "openclaw-secops";`
`@@ -312,7 +313,55 @@ export function renderBlockedDependencyComment({`
`312`	`313`	`].join("\n");`
`313`	`314`	`}`
`314`	`315`
`315`		`-function githubApi(token) {`
	`316`	`+function githubErrorBodyTooLarge(maxBytes) {`
	`317`	+return new Error(`GitHub error response body exceeded ${maxBytes} bytes`);
	`318`	`+}`
	`319`	`+`
	`320`	`+export async function readBoundedGitHubErrorText(response, maxBytes = GITHUB_ERROR_BODY_MAX_BYTES) {`
	`321`	`+const contentLength = Number(response.headers.get("content-length") ?? "");`
	`322`	`+if (Number.isSafeInteger(contentLength) && contentLength > maxBytes) {`
	`323`	`+await response.body?.cancel().catch(() => undefined);`
	`324`	`+throw githubErrorBodyTooLarge(maxBytes);`
	`325`	`+}`
	`326`	`+if (!response.body) {`
	`327`	`+return "";`
	`328`	`+}`
	`329`	`+`
	`330`	`+const reader = response.body.getReader();`
	`331`	`+const decoder = new TextDecoder();`
	`332`	`+const chunks = [];`
	`333`	`+let totalBytes = 0;`
	`334`	`+let canceled = false;`
	`335`	`+`
	`336`	`+try {`
	`337`	`+for (;;) {`
	`338`	`+const { done, value } = await reader.read();`
	`339`	`+if (done) {`
	`340`	`+const tail = decoder.decode();`
	`341`	`+if (tail) {`
	`342`	`+chunks.push(tail);`
	`343`	`+}`
	`344`	`+break;`
	`345`	`+}`
	`346`	`+`
	`347`	`+totalBytes += value.byteLength;`
	`348`	`+if (totalBytes > maxBytes) {`
	`349`	`+canceled = true;`
	`350`	`+await reader.cancel().catch(() => undefined);`
	`351`	`+throw githubErrorBodyTooLarge(maxBytes);`
	`352`	`+}`
	`353`	`+chunks.push(decoder.decode(value, { stream: true }));`
	`354`	`+}`
	`355`	`+} finally {`
	`356`	`+if (!canceled) {`
	`357`	`+reader.releaseLock();`
	`358`	`+}`
	`359`	`+}`
	`360`	`+`
	`361`	`+return chunks.join("");`
	`362`	`+}`
	`363`	`+`
	`364`	`+export function githubApi(token) {`
`316`	`365`	`const baseHeaders = {`
`317`	`366`	`accept: "application/vnd.github+json",`
`318`	`367`	authorization: `Bearer ${token}`,
`@@ -328,9 +377,13 @@ function githubApi(token) {`
`328`	`377`	`return null;`
`329`	`378`	`}`
`330`	`379`	`if (!response.ok) {`
`331`		`-const error = new Error(`
`332`		-`${response.status} ${response.statusText}: ${await response.text()}`,
`333`		`-);`
	`380`	`+let errorText;`
	`381`	`+try {`
	`382`	`+errorText = await readBoundedGitHubErrorText(response);`
	`383`	`+} catch (bodyError) {`
	`384`	`+errorText = bodyError instanceof Error ? bodyError.message : String(bodyError);`
	`385`	`+}`
	`386`	+const error = new Error(`${response.status} ${response.statusText}: ${errorText}`);
`334`	`387`	`error.status = response.status;`
`335`	`388`	`throw error;`
`336`	`389`	`}`

Original file line number	Diff line number	Diff line change
`@@ -1,14 +1,17 @@`
`1`	`1`	`import { describe, expect, it } from "vitest";`
`2`	`2`	`import {`
	`3`	`+GITHUB_ERROR_BODY_MAX_BYTES,`
`3`	`4`	`dependencyGuardCommentHeadSha,`
`4`	`5`	`dependencyFieldChanges,`
`5`	`6`	`dependencyOverrideExpectedSha,`
`6`	`7`	`findDependencyOverrideCommand,`
`7`	`8`	`findDependencyOverrideCommandAsync,`
	`9`	`+githubApi,`
`8`	`10`	`isDependencyGuardAuthorizedForHead,`
`9`	`11`	`isDependencyFile,`
`10`	`12`	`isDependencyManifest,`
`11`	`13`	`isPackageLockfile,`
	`14`	`+readBoundedGitHubErrorText,`
`12`	`15`	`renderAuthorizedDependencyComment,`
`13`	`16`	`renderBlockedDependencyComment,`
`14`	`17`	`renderClearedDependencyGuardComment,`
`@@ -269,4 +272,54 @@ describe("dependency guard script", () => {`
`269`	`272`	`expect(sanitizeDisplayValue("abc\u0000def")).toBe("abc?def");`
`270`	`273`	`expect(sanitizeDisplayValue("x".repeat(300))).toHaveLength(240);`
`271`	`274`	`});`
	`275`	`+`
	`276`	`+it("bounds GitHub error bodies by content-length", async () => {`
	`277`	`+const response = new Response("ignored", {`
	`278`	`+headers: { "content-length": String(GITHUB_ERROR_BODY_MAX_BYTES + 1) },`
	`279`	`+});`
	`280`	`+`
	`281`	`+await expect(readBoundedGitHubErrorText(response)).rejects.toThrow(`
	`282`	+`GitHub error response body exceeded ${GITHUB_ERROR_BODY_MAX_BYTES} bytes`,
	`283`	`+);`
	`284`	`+});`
	`285`	`+`
	`286`	`+it("bounds GitHub error bodies by streamed bytes", async () => {`
	`287`	`+const response = new Response(`
	`288`	`+new ReadableStream({`
	`289`	`+start(controller) {`
	`290`	`+controller.enqueue(new Uint8Array(GITHUB_ERROR_BODY_MAX_BYTES + 1));`
	`291`	`+controller.close();`
	`292`	`+},`
	`293`	`+}),`
	`294`	`+);`
	`295`	`+`
	`296`	`+await expect(readBoundedGitHubErrorText(response)).rejects.toThrow(`
	`297`	+`GitHub error response body exceeded ${GITHUB_ERROR_BODY_MAX_BYTES} bytes`,
	`298`	`+);`
	`299`	`+});`
	`300`	`+`
	`301`	`+it("preserves GitHub status when an error body exceeds the cap", async () => {`
	`302`	`+const originalFetch = globalThis.fetch;`
	`303`	`+globalThis.fetch = (() =>`
	`304`	`+Promise.resolve(`
	`305`	`+new Response(`
	`306`	`+new ReadableStream({`
	`307`	`+start(controller) {`
	`308`	`+controller.enqueue(new Uint8Array(GITHUB_ERROR_BODY_MAX_BYTES + 1));`
	`309`	`+controller.close();`
	`310`	`+},`
	`311`	`+}),`
	`312`	`+{ status: 403, statusText: "Forbidden" },`
	`313`	`+),`
	`314`	`+)) as typeof fetch;`
	`315`	`+`
	`316`	`+try {`
	`317`	`+await expect(githubApi("token").request("/repos/openclaw/openclaw")).rejects.toMatchObject({`
	`318`	+message: `403 Forbidden: GitHub error response body exceeded ${GITHUB_ERROR_BODY_MAX_BYTES} bytes`,
	`319`	`+status: 403,`
	`320`	`+});`
	`321`	`+} finally {`
	`322`	`+globalThis.fetch = originalFetch;`
	`323`	`+}`
	`324`	`+});`
`272`	`325`	`});`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main