惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

IntelliJ IDEA : IntelliJ IDEA – the Leading IDE for Professional Development in Java and Kotlin | The JetBrains Blog
IntelliJ IDEA : IntelliJ IDEA – the Leading IDE for Professional Development in Java and Kotlin | The JetBrains Blog
C
CXSECURITY Database RSS Feed - CXSecurity.com
博客园_首页
H
Hackread – Cybersecurity News, Data Breaches, AI and More
T
ThreatConnect
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
博客园 - 聂微东
H
Help Net Security
T
Threat Research - Cisco Blogs
Blog — PlanetScale
Blog — PlanetScale
A
Arctic Wolf
G
Google Developers Blog
量子位
U
Unit 42
I
InfoQ
V
V2EX
F
Fox-IT International blog
P
Privacy & Cybersecurity Law Blog
V
Visual Studio Blog
J
Java Code Geeks
大猫的无限游戏
大猫的无限游戏
C
CERT Recently Published Vulnerability Notes
博客园 - 三生石上(FineUI控件)
T
The Exploit Database - CXSecurity.com
T
Tailwind CSS Blog
SecWiki News
SecWiki News
Know Your Adversary
Know Your Adversary
MyScale Blog
MyScale Blog
宝玉的分享
宝玉的分享
The Hacker News
The Hacker News
Project Zero
Project Zero
Application and Cybersecurity Blog
Application and Cybersecurity Blog
月光博客
月光博客
Recent Commits to openclaw:main
Recent Commits to openclaw:main
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
G
GRAHAM CLULEY
C
Cisco Blogs
I
Intezer
Simon Willison's Weblog
Simon Willison's Weblog
O
OpenAI News
Recorded Future
Recorded Future
T
Tenable Blog
W
WeLiveSecurity
腾讯CDC
Stack Overflow Blog
Stack Overflow Blog
T
The Blog of Author Tim Ferriss
www.infosecurity-magazine.com
www.infosecurity-magazine.com
D
Docker
C
Cybersecurity and Infrastructure Security Agency CISA
PCI Perspectives
PCI Perspectives

Recent Commits to openclaw:main

fix: parse google meet cli numbers strictly fix: parse google meet env numbers strictly fix: parse signal archive length strictly refactor: route node proxy agents through proxyline docs: clarify Codex native hook relay recovery fix: parse discord rate limit headers strictly fix: parse codex retry headers strictly · openclaw/openclaw@bcf354e fix(ollama): promote plain text tool calls · openclaw/openclaw@21e69fd fix: parse provider retry dates strictly · openclaw/openclaw@7859ee3 fix: parse discord api retry headers strictly · openclaw/openclaw@5eee488 fix: parse discord retry delays strictly · openclaw/openclaw@1d28dd8 fix: parse feishu startup timeout env strictly · openclaw/openclaw@a8991e0 fix: parse feishu timeout env strictly fix: parse telegram qa timeout env strictly · openclaw/openclaw@21db3ff fix: parse qa credential integer env strictly · openclaw/openclaw@19d1c21 fix(media): compact whatsapp terminal qr (#87581) · openclaw/openclaw@492105d fix: parse qa worker stagger env strictly · openclaw/openclaw@d3b5413 fix: parse qa transport timeout env strictly · openclaw/openclaw@2e8b344 fix: parse qa process metrics strictly · openclaw/openclaw@339a74a fix: parse codex computer use timeout env strictly · openclaw/openclaw@5b79ab0 fix: parse codex migration timeout env strictly · openclaw/openclaw@929b3a4 fix: parse qa suite concurrency env strictly · openclaw/openclaw@2cde331 fix(ci): raise plugin sdk strict smoke heap (#87729) · openclaw/openclaw@5f9d71f fix: parse embedded abort settle timeout strictly · openclaw/openclaw@df4475d fix: parse sdk retry wait env strictly · openclaw/openclaw@f90e266 fix(e2e): bound OpenWebUI probe response bodies · openclaw/openclaw@bbc9a7d fix: parse queue caps strictly · openclaw/openclaw@d47eee4 fix: parse gateway usage days strictly · openclaw/openclaw@2122dcc fix: parse http idle timeout strings strictly · openclaw/openclaw@d08bcb4 fix: parse cleanup timeout env strictly · openclaw/openclaw@42688f5 fix: parse handshake timeout env strictly · openclaw/openclaw@d6c8e05 fix: parse cron stagger strings strictly · openclaw/openclaw@ca87241 fix: reject invalid cron epoch timestamps fix: parse cron task run ids strictly fix(native-hook-relay): prune stale bridge files on registration (#87… · openclaw/openclaw@202ccf4 test: cover dynamic live model refs fix: reject malformed media content length fix: parse ffprobe sample rates strictly chore: update dependency pins · openclaw/openclaw@c2c2958 fix: parse ps cpu time formats fix: clamp read tool line limits · openclaw/openclaw@5393240 fix: parse sandbox stat fields strictly · openclaw/openclaw@5ebf3b0 fix(scripts): give boundary root shims macos headroom · openclaw/openclaw@ea0b6bc fix(e2e): bound kitchen sink rpc probe bodies · openclaw/openclaw@5fc5aa8 fix: honor bare ipv6 no_proxy entries fix: honor ipv6 no_proxy entries · openclaw/openclaw@e205888 perf: reduce latency across async I/O hot paths · openclaw/openclaw@53475c2 fix: count qmd output caps by code point · openclaw/openclaw@9e1faf8 fix: cap chrome mcp stderr by utf8 bytes · openclaw/openclaw@f4f059e [codex] Use clawpdf for PDF extraction (#87670) fix: keep stderr tail within utf8 byte cap · openclaw/openclaw@478e0ec fix(images): skip CLI image cache refs (#87523) · openclaw/openclaw@51e2401 fix(ui): preserve session picker on empty search blur (#87682) · openclaw/openclaw@e9655b9 fix: parse lsp content length by byte fix(agents): surface MCP structured content in tool results · openclaw/openclaw@2df8021 fix(voice-call): make webhook replays token-safe · openclaw/openclaw@cd0b692 fix(scripts): bound Z.AI fallback repro output · openclaw/openclaw@716fd67 perf: cache bundled channel entry resolution · openclaw/openclaw@a85ff92 fix(webchat): preserve sends through reconnect (#87531) fix: reject malformed inspected tcp ports · openclaw/openclaw@c00ac95 fix: reject malformed marketplace content length fix: reject exponent provider integer options · openclaw/openclaw@03e6181 fix(sessions): recover empty preflight compaction · openclaw/openclaw@5f88932 perf: reduce gateway startup sidecar overhead fix: canonicalize secret target array indexes · openclaw/openclaw@e67ff0c fix: harden config array index parsing feat(gateway): show warm MCP tools in effective inventory fix(approvals): restore reaction command prompt lines fix(scripts): bound control UI i18n process output · openclaw/openclaw@e707b45 docs: remove public GHSA fix mechanism details · openclaw/openclaw@79e733c fix(agents): concatenate signature_delta chunks in transport stream · openclaw/openclaw@8dc9cfe fix(agents): handle seeded Anthropic signatures · openclaw/openclaw@f8c8c0d fix(auto-reply): respect provider for directive persistence (#87683) fix(agents): preserve reasoning_content replay across DeepSeek tier s… docs: treat CLI setup flows as API contracts (#87685) docs: harden GHSA wording guidance · openclaw/openclaw@b601550 fix(openrouter): apply strict9 ids to Mistral routes · openclaw/openclaw@ad1d8bf perf: cache plugin module exports per loader perf: prefer built bundled runtime surfaces · openclaw/openclaw@81c90aa Block provider credentials from workspace dotenv [AI] (#83655) · openclaw/openclaw@85277c2 fix(core): restore changed gate typecheck · openclaw/openclaw@9adbab0 fix(agents): quarantine compaction tool schemas · openclaw/openclaw@83bb5fb fix: reject partial numeric parsing · openclaw/openclaw@b6ef874 perf: reduce gateway runtime discovery overhead · openclaw/openclaw@68e6f03 fix(codex): bound sandbox http stream lines · openclaw/openclaw@7b5f0c2 fix(ssh): bound config probe output · openclaw/openclaw@3e2994b fix(msteams): bind bot framework service urls (#87160) · openclaw/openclaw@2c3d7f5 fix(telegram): bound proof command output fix(daemon): preserve explicit systemd unit during refresh fix(gateway): preserve traced child sessions · openclaw/openclaw@3f3ed5e feat(ios): refresh pro UI and gateway flows (#87367) fix(imessage): bound cli output capture · openclaw/openclaw@65d47dc fix(auto-reply): bound scp staging stderr · openclaw/openclaw@b474130 fix(voice-call): ignore tailscale helper stderr · openclaw/openclaw@76f447b fix(voice-call): ignore ngrok probe output · openclaw/openclaw@bc6ecc8 fix(voice-call): drain tailscale tunnel output fix(scripts): bound boundary check output fix(voice-call): bound tailscale status output docs: point release process at public evidence repo · openclaw/openclaw@910354b fix(telegram): retain streamed long final prefixes · openclaw/openclaw@27d57af
fix(e2e): bound telegram credential broker bodies · openclaw/openclaw@8338986
vincentkoc · 2026-05-29 · via Recent Commits to openclaw:main

@@ -6,6 +6,7 @@ type FetchJsonParams = {

66

fetchImpl?: (url: string, init: RequestInit) => Promise<Response>;

77

init: RequestInit;

88

label: string;

9+

maxBodyBytes?: number;

910

timeoutMs: number;

1011

url: string;

1112

};

@@ -17,12 +18,42 @@ type RunCommandOptions = {

1718

};

18191920

const DEFAULT_OUTPUT_LIMIT = 128 * 1024;

21+

const DEFAULT_FETCH_BODY_LIMIT = 1024 * 1024;

2022

const KILL_GRACE_MS = 5_000;

21232224

function timeoutError(message: string) {

2325

return Object.assign(new Error(message), { code: "ETIMEDOUT" });

2426

}

252728+

function bodyTooLargeError(message: string) {

29+

return Object.assign(new Error(message), { code: "ETOOBIG" });

30+

}

31+32+

function resolveFetchBodyLimit(limit: number | undefined) {

33+

if (limit !== undefined) {

34+

if (!Number.isSafeInteger(limit) || limit < 1) {

35+

throw new Error(`fetch JSON body limit must be a positive integer; got: ${limit}`);

36+

}

37+

return limit;

38+

}

39+

const raw = process.env.OPENCLAW_QA_CREDENTIAL_HTTP_MAX_BODY_BYTES?.trim();

40+

if (!raw) {

41+

return DEFAULT_FETCH_BODY_LIMIT;

42+

}

43+

if (!/^\d+$/u.test(raw)) {

44+

throw new Error(

45+

`OPENCLAW_QA_CREDENTIAL_HTTP_MAX_BODY_BYTES must be a positive integer; got: ${raw}`,

46+

);

47+

}

48+

const parsed = Number(raw);

49+

if (!Number.isSafeInteger(parsed) || parsed < 1) {

50+

throw new Error(

51+

`OPENCLAW_QA_CREDENTIAL_HTTP_MAX_BODY_BYTES must be a positive integer; got: ${raw}`,

52+

);

53+

}

54+

return parsed;

55+

}

56+2657

function appendBounded(previous: string, chunk: Buffer, limit: number) {

2758

const next = previous + chunk.toString();

2859

if (next.length <= limit) {

@@ -107,8 +138,49 @@ export function runCommand(

107138

});

108139

}

109140141+

async function readBoundedResponseText(

142+

response: Response,

143+

label: string,

144+

byteLimit: number,

145+

timeoutPromise: Promise<never>,

146+

) {

147+

const contentLength = response.headers.get("content-length");

148+

if (contentLength) {

149+

const parsedLength = Number(contentLength);

150+

if (Number.isSafeInteger(parsedLength) && parsedLength > byteLimit) {

151+

await response.body?.cancel().catch(() => {});

152+

throw bodyTooLargeError(`${label} response body exceeded ${byteLimit} bytes`);

153+

}

154+

}

155+

if (!response.body) {

156+

return "";

157+

}

158+159+

const reader = response.body.getReader();

160+

const decoder = new TextDecoder();

161+

let byteCount = 0;

162+

let text = "";

163+

try {

164+

while (true) {

165+

const { done, value } = await Promise.race([reader.read(), timeoutPromise]);

166+

if (done) {

167+

return text + decoder.decode();

168+

}

169+

byteCount += value.byteLength;

170+

if (byteCount > byteLimit) {

171+

await reader.cancel().catch(() => {});

172+

throw bodyTooLargeError(`${label} response body exceeded ${byteLimit} bytes`);

173+

}

174+

text += decoder.decode(value, { stream: true });

175+

}

176+

} finally {

177+

reader.releaseLock();

178+

}

179+

}

180+110181

export async function fetchJsonWithTimeout(params: FetchJsonParams) {

111182

const timeoutMs = Math.max(1, params.timeoutMs);

183+

const maxBodyBytes = resolveFetchBodyLimit(params.maxBodyBytes);

112184

const controller = new AbortController();

113185

const error = timeoutError(`${params.label} timed out after ${timeoutMs}ms`);

114186

let timeout: NodeJS.Timeout | undefined;

@@ -128,7 +200,13 @@ export async function fetchJsonWithTimeout(params: FetchJsonParams) {

128200

}),

129201

timeoutPromise,

130202

]);

131-

const payload = (await Promise.race([response.json(), timeoutPromise])) as JsonObject;

203+

const rawPayload = await readBoundedResponseText(

204+

response,

205+

params.label,

206+

maxBodyBytes,

207+

timeoutPromise,

208+

);

209+

const payload = JSON.parse(rawPayload) as JsonObject;

132210

return { payload, response };

133211

} finally {

134212

if (timeout) {