fix(e2e): reject unsafe bounded response text lengths · openclaw/openclaw@0f18e82
vincentkoc
·
2026-06-20
·
via Recent Commits to openclaw:main
| Original file line number | Diff line number | Diff line change |
|---|
@@ -17,7 +17,7 @@ function parseContentLengthHeader(headers) {
|
17 | 17 | return undefined; |
18 | 18 | } |
19 | 19 | const parsed = Number(raw); |
20 | | -return Number.isSafeInteger(parsed) ? parsed : undefined; |
| 20 | +return Number.isSafeInteger(parsed) ? parsed : Number.POSITIVE_INFINITY; |
21 | 21 | } |
22 | 22 | |
23 | 23 | export async function readBoundedResponseText(response, label, byteLimit, timeoutPromise) { |
|
| Original file line number | Diff line number | Diff line change |
|---|
@@ -111,4 +111,36 @@ describe("scripts/e2e/lib/bounded-response-text.mjs", () => {
|
111 | 111 | expect(readStarted).toBe(true); |
112 | 112 | expect(canceled).toBe(true); |
113 | 113 | }); |
| 114 | + |
| 115 | +it("rejects unsafe decimal content-length values before reading", async () => { |
| 116 | +let readStarted = false; |
| 117 | +let canceled = false; |
| 118 | +const response = { |
| 119 | +headers: new Headers({ "content-length": "9007199254740993" }), |
| 120 | +body: { |
| 121 | +async cancel() { |
| 122 | +canceled = true; |
| 123 | +}, |
| 124 | +getReader() { |
| 125 | +return { |
| 126 | +async read() { |
| 127 | +readStarted = true; |
| 128 | +return new Promise<ReadableStreamReadResult<Uint8Array>>(() => {}); |
| 129 | +}, |
| 130 | +async cancel() { |
| 131 | +canceled = true; |
| 132 | +}, |
| 133 | +releaseLock() {}, |
| 134 | +}; |
| 135 | +}, |
| 136 | +}, |
| 137 | +}; |
| 138 | + |
| 139 | +await expect(readBoundedResponseText(response, "probe", 16)).rejects.toMatchObject({ |
| 140 | +code: "ETOOBIG", |
| 141 | +message: "probe response body exceeded 16 bytes", |
| 142 | +}); |
| 143 | +expect(readStarted).toBe(false); |
| 144 | +expect(canceled).toBe(true); |
| 145 | +}); |
114 | 146 | }); |
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
