@@ -3,7 +3,7 @@ import { generateKeyPairSync, sign } from "node:crypto";
33import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
44import { tmpdir } from "node:os";
55import { dirname, join } from "node:path";
6-import { describe, expect, it } from "vitest";
6+import { describe, expect, it, vi } from "vitest";
77import {
88buildPublishedInstallCommandArgs,
99buildPublishedInstallScenarios,
@@ -12,6 +12,7 @@ import {
1212collectInstalledPluginSdkZodArtifactErrors,
1313collectInstalledRootDependencyManifestErrors,
1414collectInstalledPackageErrors,
15+fetchRegistryJson,
1516normalizeInstalledBinaryVersion,
1617resolveInstalledBinaryCommandInvocation,
1718resolveInstalledBinaryPath,
@@ -88,6 +89,59 @@ describe("npm registry provenance verification", () => {
8889},
8990};
909192+it("fetches npm registry JSON with bounded response handling", async () => {
93+const fetchImpl = vi.fn(async (_url: string, init?: RequestInit) => {
94+expect(init).toMatchObject({
95+headers: {
96+Accept: "application/json",
97+},
98+redirect: "error",
99+signal: expect.any(AbortSignal),
100+});
101+return new Response(JSON.stringify({ ok: true }));
102+});
103+104+await expect(
105+fetchRegistryJson("https://registry.example/openclaw", {
106+ fetchImpl,
107+timeoutMs: 1234,
108+}),
109+).resolves.toEqual({ ok: true });
110+});
111+112+it("bounds oversized npm registry response bodies", async () => {
113+const fetchImpl = vi.fn(async () => {
114+return new Response("x".repeat(65), {
115+headers: { "content-length": "65" },
116+});
117+});
118+119+await expect(
120+fetchRegistryJson("https://registry.example/openclaw", {
121+ fetchImpl,
122+maxBodyBytes: 64,
123+timeoutMs: 1234,
124+}),
125+).rejects.toThrow(
126+"npm registry https://registry.example/openclaw response body exceeded 64 bytes",
127+);
128+});
129+130+it("keeps npm registry timeouts active while reading response bodies", async () => {
131+const fetchImpl = vi.fn(async () => {
132+return new Response(new ReadableStream<Uint8Array>({ start() {} }));
133+});
134+135+await expect(
136+fetchRegistryJson("https://registry.example/openclaw", {
137+ fetchImpl,
138+timeoutMs: 5,
139+}),
140+).rejects.toThrow(
141+"npm registry request timed out after 5ms: https://registry.example/openclaw",
142+);
143+});
144+91145it("verifies an npm registry signature against the matching public key", () => {
92146const keys = generateKeyPairSync("ec", { namedCurve: "prime256v1" });
93147const payload = `${packageName}@${version}:${integrity}`;
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。