@@ -219,6 +219,24 @@ describe("downloadToFile", () => {
219219expect(fetchResult.release).toHaveBeenCalledTimes(1);
220220});
221221222+it.each(["1e3", "0x10", `1${"0".repeat(309)}`])(
223+"ignores malformed declared archive lengths: %s",
224+async (contentLength) => {
225+const fetchResult = okDownloadResponse("archive", {
226+headers: { "content-length": contentLength },
227+});
228+fetchWithSsrFGuardMock.mockResolvedValue(fetchResult);
229+230+await withTempFile(async (filePath) => {
231+await downloadToFile("https://example.com/signal-cli.tgz", filePath, 5, 8);
232+233+await expect(fs.readFile(filePath, "utf-8")).resolves.toBe("archive");
234+});
235+236+expect(fetchResult.release).toHaveBeenCalledTimes(1);
237+},
238+);
239+222240it("aborts streamed archives above the download cap and removes partial files", async () => {
223241const body = new ReadableStream<Uint8Array>({
224242start(controller) {
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。