fix(discord): reject unsafe retry-after delays · openclaw...

Recent Commits to openclaw:main

steipete · 2026-05-29 · via Recent Commits to openclaw:main

Original file line number	Diff line number	Diff line change
`@@ -103,6 +103,8 @@ describe("fetchDiscord", () => {`
`103`	`103`	`it.each([`
`104`	`104`	`["hex", "0x10"],`
`105`	`105`	`["fractional", "1.5"],`
	`106`	`+["unsafe-ms", "9007199254741"],`
	`107`	`+["unsafe-integer", "9007199254740993"],`
`106`	`108`	["overflow", `1${"0".repeat(309)}`],
`107`	`109`	`])("rejects invalid Retry-After header values: %s", async (_label, header) => {`
`108`	`110`	`const fetcher = withFetchPreconnect(`
`@@ -126,6 +128,33 @@ describe("fetchDiscord", () => {`
`126`	`128`	`expect((error as DiscordApiError).retryAfter).toBe(60);`
`127`	`129`	`});`
`128`	`130`
	`131`	`+it("ignores unsafe retry_after body values and falls back to Retry-After", async () => {`
	`132`	`+const fetcher = withFetchPreconnect(`
	`133`	`+async () =>`
	`134`	`+new Response(`
	`135`	`+JSON.stringify({`
	`136`	`+message: "You are being rate limited.",`
	`137`	`+retry_after: 9_007_199_254_741,`
	`138`	`+global: false,`
	`139`	`+}),`
	`140`	`+{ status: 429, headers: { "retry-after": "7" } },`
	`141`	`+),`
	`142`	`+);`
	`143`	`+`
	`144`	`+let error: unknown;`
	`145`	`+try {`
	`146`	`+await fetchDiscord("/users/@me/guilds", "test", fetcher, {`
	`147`	`+retry: { attempts: 1 },`
	`148`	`+});`
	`149`	`+} catch (err) {`
	`150`	`+error = err;`
	`151`	`+}`
	`152`	`+`
	`153`	`+expect(error).toBeInstanceOf(DiscordApiError);`
	`154`	`+expect((error as DiscordApiError).retryAfter).toBe(7);`
	`155`	`+expect(String(error)).not.toContain("retry after");`
	`156`	`+});`
	`157`	`+`
`129`	`158`	`it("retries rate limits before succeeding", async () => {`
`130`	`159`	`let calls = 0;`
`131`	`160`	`const fetcher = withFetchPreconnect(async () => {`

Original file line number	Diff line number	Diff line change
`@@ -5,7 +5,7 @@ import {`
`5`	`5`	`type RetryConfig,`
`6`	`6`	`} from "openclaw/plugin-sdk/retry-runtime";`
`7`	`7`	`import { isDiscordHtmlResponseBody, summarizeDiscordResponseBody } from "./error-body.js";`
`8`		`-import { parseRetryAfterHeaderSeconds } from "./retry-after.js";`
	`8`	`+import { parseDiscordRetryAfterBodySeconds, parseRetryAfterHeaderSeconds } from "./retry-after.js";`
`9`	`9`
`10`	`10`	`const DISCORD_API_BASE = "https://discord.com/api/v10";`
`11`	`11`	`const DISCORD_API_RETRY_DEFAULTS = {`
`@@ -41,10 +41,7 @@ function parseDiscordApiErrorPayload(text: string): DiscordApiErrorPayload \| nul`
`41`	`41`
`42`	`42`	`function parseRetryAfterSeconds(text: string, response: Response): number \| undefined {`
`43`	`43`	`const payload = parseDiscordApiErrorPayload(text);`
`44`		`-const retryAfter =`
`45`		`-payload && typeof payload.retry_after === "number" && Number.isFinite(payload.retry_after)`
`46`		`- ? payload.retry_after`
`47`		`- : undefined;`
	`44`	`+const retryAfter = parseDiscordRetryAfterBodySeconds(payload?.retry_after);`
`48`	`45`	`if (retryAfter !== undefined) {`
`49`	`46`	`return retryAfter;`
`50`	`47`	`}`
`@@ -88,7 +85,7 @@ function formatDiscordApiErrorText(text: string, response: Response): string \| u`
`88`	`85`	`? payload.message.trim()`
`89`	`86`	`: "unknown error";`
`90`	`87`	`const retryAfter = formatRetryAfterSeconds(`
`91`		`-typeof payload.retry_after === "number" ? payload.retry_after : undefined,`
	`88`	`+parseDiscordRetryAfterBodySeconds(payload.retry_after),`
`92`	`89`	`);`
`93`	`90`	return retryAfter ? `${message} (retry after ${retryAfter})` : message;
`94`	`91`	`}`

Original file line number	Diff line number	Diff line change
`@@ -620,9 +620,27 @@ describe("RequestClient", () => {`
`620`	`620`	`await expectRateLimitError(client.get("/channels/c1/messages"), { retryAfter: 7 });`
`621`	`621`	`});`
`622`	`622`
	`623`	`+it("falls back to Retry-After when the rate limit body value is unsafe", async () => {`
	`624`	`+const client = new RequestClient("test-token", {`
	`625`	`+queueRequests: false,`
	`626`	`+fetch: async () =>`
	`627`	`+new Response(`
	`628`	`+JSON.stringify({ message: "Slow down", retry_after: "9007199254741", global: false }),`
	`629`	`+{`
	`630`	`+status: 429,`
	`631`	`+headers: { "Retry-After": "7" },`
	`632`	`+},`
	`633`	`+),`
	`634`	`+});`
	`635`	`+`
	`636`	`+await expectRateLimitError(client.get("/channels/c1/messages"), { retryAfter: 7 });`
	`637`	`+});`
	`638`	`+`
`623`	`639`	`it.each([`
`624`	`640`	`["hex", "0x10"],`
`625`	`641`	`["fractional", "1.5"],`
	`642`	`+["unsafe-ms", "9007199254741"],`
	`643`	`+["unsafe-integer", "9007199254740993"],`
`626`	`644`	["overflow", `1${"0".repeat(309)}`],
`627`	`645`	`])("rejects invalid Retry-After numeric strings: %s", async (_label, header) => {`
`628`	`646`	`const client = new RequestClient("test-token", {`

Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,14 @@`
	`1`	`+import {`
	`2`	`+asFiniteNumberInRange,`
	`3`	`+parseStrictFiniteNumber,`
	`4`	`+parseStrictNonNegativeInteger,`
	`5`	`+} from "openclaw/plugin-sdk/number-runtime";`
	`6`	`+`
`1`	`7`	`const RETRY_AFTER_HEADER_DELAY_RE = /^\d+$/;`
`2`	`8`	`const RETRY_AFTER_BODY_SECONDS_RE = /^(?:\d+\.?\d*\|\.\d+)$/;`
`3`	`9`	`const RETRY_AFTER_HTTP_DATE_RE =`
`4`	`10`	`/^(?:Mon\|Tue\|Wed\|Thu\|Fri\|Sat\|Sun), \d{2} (?:Jan\|Feb\|Mar\|Apr\|May\|Jun\|Jul\|Aug\|Sep\|Oct\|Nov\|Dec) \d{4} \d{2}:\d{2}:\d{2} GMT$/;`
	`11`	`+const MAX_SAFE_RETRY_AFTER_SECONDS = Number.MAX_SAFE_INTEGER / 1000;`
`5`	`12`
`6`	`13`	`export function parseRetryAfterHeaderSeconds(`
`7`	`14`	`value: string \| null \| undefined,`
`@@ -12,8 +19,10 @@ export function parseRetryAfterHeaderSeconds(`
`12`	`19`	`}`
`13`	`20`	`const trimmed = value.trim();`
`14`	`21`	`if (RETRY_AFTER_HEADER_DELAY_RE.test(trimmed)) {`
`15`		`-const delaySeconds = Number(trimmed);`
`16`		`-return Number.isFinite(delaySeconds) ? delaySeconds : undefined;`
	`22`	`+return asFiniteNumberInRange(parseStrictNonNegativeInteger(trimmed), {`
	`23`	`+min: 0,`
	`24`	`+max: MAX_SAFE_RETRY_AFTER_SECONDS,`
	`25`	`+});`
`17`	`26`	`}`
`18`	`27`	`if (!RETRY_AFTER_HTTP_DATE_RE.test(trimmed)) {`
`19`	`28`	`return undefined;`
`@@ -27,7 +36,7 @@ export function parseDiscordRetryAfterBodySeconds(value: unknown): number \| unde`
`27`	`36`	`typeof value === "number"`
`28`	`37`	`? value`
`29`	`38`	`: typeof value === "string" && RETRY_AFTER_BODY_SECONDS_RE.test(value.trim())`
`30`		`- ? Number(value.trim())`
	`39`	`+ ? parseStrictFiniteNumber(value.trim())`
`31`	`40`	`: undefined;`
`32`		`-return seconds !== undefined && Number.isFinite(seconds) && seconds >= 0 ? seconds : undefined;`
	`41`	`+return asFiniteNumberInRange(seconds, { min: 0, max: MAX_SAFE_RETRY_AFTER_SECONDS });`
`33`	`42`	`}`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main