fix(slack): reject unsafe inbound timestamps · openclaw/openclaw@f2ba234
steipete
·
2026-05-29
·
via Recent Commits to openclaw:main
File tree
extensions/slack/src/monitor/message-handler
| Original file line number | Diff line number | Diff line change |
|---|
@@ -12,4 +12,9 @@ describe("resolveSlackTimestampMs", () => {
|
12 | 12 | expect(resolveSlackTimestampMs("1e3")).toBeUndefined(); |
13 | 13 | expect(resolveSlackTimestampMs("Infinity")).toBeUndefined(); |
14 | 14 | }); |
| 15 | + |
| 16 | +it("rejects timestamps that would produce unsafe millisecond values", () => { |
| 17 | +expect(resolveSlackTimestampMs("9007199254741")).toBeUndefined(); |
| 18 | +expect(resolveSlackTimestampMs("9007199254740993")).toBeUndefined(); |
| 19 | +}); |
15 | 20 | }); |
| Original file line number | Diff line number | Diff line change |
|---|
|
| 1 | +import { asFiniteNumberInRange, parseStrictFiniteNumber } from "openclaw/plugin-sdk/number-runtime"; |
| 2 | + |
1 | 3 | const SLACK_TIMESTAMP_RE = /^\d+(?:\.\d+)?$/; |
| 4 | +const MAX_SAFE_SLACK_TIMESTAMP_SECONDS = Number.MAX_SAFE_INTEGER / 1000; |
2 | 5 | |
3 | 6 | export function resolveSlackTimestampMs(ts: string | undefined): number | undefined { |
4 | 7 | const trimmed = ts?.trim(); |
5 | 8 | if (!trimmed || !SLACK_TIMESTAMP_RE.test(trimmed)) { |
6 | 9 | return undefined; |
7 | 10 | } |
8 | | -const parsed = Number(trimmed); |
9 | | -return Number.isFinite(parsed) ? Math.round(parsed * 1000) : undefined; |
| 11 | +const seconds = asFiniteNumberInRange(parseStrictFiniteNumber(trimmed), { |
| 12 | +min: 0, |
| 13 | +max: MAX_SAFE_SLACK_TIMESTAMP_SECONDS, |
| 14 | +}); |
| 15 | +return seconds === undefined ? undefined : Math.round(seconds * 1000); |
10 | 16 | } |
此内容由惯性聚合(RSS阅读器)自动聚合整理,仅供阅读参考。 原文来自 — 版权归原作者所有。