fix(slack): cancel followed redirect bodies · openclaw/op...

Recent Commits to openclaw:main

vincentkoc · 2026-06-19 · via Recent Commits to openclaw:main

File tree

extensions/slack/src/monitor

Original file line number	Diff line number	Diff line change
`@@ -291,10 +291,11 @@ describe("fetchWithSlackAuth", () => {`
`291`	`291`
`292`	`292`	`it("strips Authorization header on cross-origin redirects", async () => {`
`293`	`293`	`// First call: redirect response from Slack`
`294`		`-const redirectResponse = new Response(null, {`
	`294`	`+const redirectResponse = new Response("redirect body", {`
`295`	`295`	`status: 302,`
`296`	`296`	`headers: { location: "https://cdn.slack-edge.com/presigned-url?sig=abc123" },`
`297`	`297`	`});`
	`298`	`+const cancel = vi.spyOn(redirectResponse.body!, "cancel").mockResolvedValue(undefined);`
`298`	`299`
`299`	`300`	`// Second call: actual file content from CDN`
`300`	`301`	`const fileResponse = new Response(Buffer.from("actual image data"), {`
`@@ -321,13 +322,15 @@ describe("fetchWithSlackAuth", () => {`
`321`	`322`	`"https://cdn.slack-edge.com/presigned-url?sig=abc123",`
`322`	`323`	`{ redirect: "follow" },`
`323`	`324`	`);`
	`325`	`+expect(cancel).toHaveBeenCalledOnce();`
`324`	`326`	`});`
`325`	`327`
`326`	`328`	`it("preserves Authorization header on same-origin redirects", async () => {`
`327`		`-const redirectResponse = new Response(null, {`
	`329`	`+const redirectResponse = new Response("redirect body", {`
`328`	`330`	`status: 302,`
`329`	`331`	`headers: { location: "/files/redirect-target" },`
`330`	`332`	`});`
	`333`	`+const cancel = vi.spyOn(redirectResponse.body!, "cancel").mockResolvedValue(undefined);`
`331`	`334`
`332`	`335`	`const fileResponse = new Response(Buffer.from("image data"), {`
`333`	`336`	`status: 200,`
`@@ -342,6 +345,7 @@ describe("fetchWithSlackAuth", () => {`
`342`	`345`	`headers: { Authorization: "Bearer xoxb-test-token" },`
`343`	`346`	`redirect: "follow",`
`344`	`347`	`});`
	`348`	`+expect(cancel).toHaveBeenCalledOnce();`
`345`	`349`	`});`
`346`	`350`
`347`	`351`	`it("returns redirect response when no location header is provided", async () => {`

Original file line number	Diff line number	Diff line change
`@@ -104,6 +104,12 @@ function resolveSlackFetchForRuntime(): typeof fetch {`
`104`	`104`	`return isMockedFetch(globalThis.fetch) ? globalThis.fetch : fetchWithRuntimeDispatcher;`
`105`	`105`	`}`
`106`	`106`
	`107`	`+async function cancelUnreadResponseBody(response: Response): Promise<void> {`
	`108`	`+if (!response.bodyUsed) {`
	`109`	`+await response.body?.cancel().catch(() => undefined);`
	`110`	`+}`
	`111`	`+}`
	`112`	`+`
`107`	`113`	`/**`
`108`	`114`	`* Fetches a URL with Authorization header while keeping same-origin redirects`
`109`	`115`	`* authenticated and dropping auth once the redirect crosses origins.`
`@@ -136,6 +142,7 @@ export async function fetchWithSlackAuth(url: string, token: string): Promise<Re`
`136`	`142`	`if (resolvedUrl.protocol !== "https:") {`
`137`	`143`	`return initialRes;`
`138`	`144`	`}`
	`145`	`+await cancelUnreadResponseBody(initialRes);`
`139`	`146`	`if (resolvedUrl.origin === parsed.origin) {`
`140`	`147`	`return fetchImpl(resolvedUrl.toString(), {`
`141`	`148`	`headers: authHeaders,`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main

File tree