fix(openai): validate codex oauth token lifetimes · openclaw/openclaw@806b3b7

Recent Commits to openclaw:main

steipete · 2026-05-29 · via Recent Commits to openclaw:main

Original file line number	Diff line number	Diff line change
`@@ -14,6 +14,20 @@ function timeoutError(): Error {`
`14`	`14`	`return new DOMException("timed out", "TimeoutError");`
`15`	`15`	`}`
`16`	`16`
	`17`	`+function mockTokenResponse(body: unknown, status = 200): void {`
	`18`	`+mockTokenResponseText(JSON.stringify(body), status);`
	`19`	`+}`
	`20`	`+`
	`21`	`+function mockTokenResponseText(body: string, status = 200): void {`
	`22`	`+ssrfMocks.fetchWithSsrFGuard.mockResolvedValueOnce({`
	`23`	`+response: new Response(body, {`
	`24`	`+ status,`
	`25`	`+headers: { "Content-Type": "application/json" },`
	`26`	`+}),`
	`27`	`+release: vi.fn(async () => undefined),`
	`28`	`+});`
	`29`	`+}`
	`30`	`+`
`17`	`31`	`afterEach(() => {`
`18`	`32`	`ssrfMocks.fetchWithSsrFGuard.mockReset();`
`19`	`33`	`});`
`@@ -110,6 +124,24 @@ describe("OpenAI Codex OAuth flow", () => {`
`110`	`124`	`});`
`111`	`125`	`});`
`112`	`126`
	`127`	`+it("rejects unsafe token exchange lifetimes", async () => {`
	`128`	`+mockTokenResponseText(`
	`129`	`+'{"access_token":"access-token","refresh_token":"refresh-token","expires_in":1e309}',`
	`130`	`+);`
	`131`	`+`
	`132`	`+const result = await testing.exchangeAuthorizationCode(`
	`133`	`+"code",`
	`134`	`+"verifier",`
	`135`	`+testing.resolveRedirectUri("localhost"),`
	`136`	`+{ timeoutMs: 5 },`
	`137`	`+);`
	`138`	`+`
	`139`	`+expect(result).toEqual({`
	`140`	`+type: "failed",`
	`141`	`+message: "OpenAI Codex token exchange response missing fields: expires_in",`
	`142`	`+});`
	`143`	`+});`
	`144`	`+`
`113`	`145`	`it("times out token refresh requests", async () => {`
`114`	`146`	`ssrfMocks.fetchWithSsrFGuard.mockRejectedValueOnce(timeoutError());`
`115`	`147`
`@@ -126,4 +158,19 @@ describe("OpenAI Codex OAuth flow", () => {`
`126`	`158`	`message: "OpenAI Codex token refresh timed out after 5ms",`
`127`	`159`	`});`
`128`	`160`	`});`
	`161`	`+`
	`162`	`+it("rejects non-positive token refresh lifetimes", async () => {`
	`163`	`+mockTokenResponse({`
	`164`	`+access_token: "access-token",`
	`165`	`+refresh_token: "refresh-token",`
	`166`	`+expires_in: 0,`
	`167`	`+});`
	`168`	`+`
	`169`	`+const result = await testing.refreshAccessToken("old-refresh-token", { timeoutMs: 5 });`
	`170`	`+`
	`171`	`+expect(result).toEqual({`
	`172`	`+type: "failed",`
	`173`	`+message: "OpenAI Codex token refresh response missing fields: expires_in",`
	`174`	`+});`
	`175`	`+});`
`129`	`176`	`});`

Original file line number	Diff line number	Diff line change
`@@ -5,6 +5,7 @@`
`5`	`5`	`* It is only intended for CLI use, not browser environments.`
`6`	`6`	`*/`
`7`	`7`
	`8`	`+import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";`
`8`	`9`	`import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";`
`9`	`10`	`import { resolveCodexAuthIdentity } from "./openai-codex-auth-identity.js";`
`10`	`11`	`import {`
`@@ -166,12 +167,17 @@ function formatMissingTokenResponseFields(json: TokenResponseJson): string {`
`166`	`167`	`if (!json.refresh_token) {`
`167`	`168`	`missing.push("refresh_token");`
`168`	`169`	`}`
`169`		`-if (typeof json.expires_in !== "number") {`
	`170`	`+if (parseStrictPositiveInteger(json.expires_in) === undefined) {`
`170`	`171`	`missing.push("expires_in");`
`171`	`172`	`}`
`172`	`173`	`return missing.join(", ");`
`173`	`174`	`}`
`174`	`175`
	`176`	`+function resolveTokenExpiresAt(expiresIn: unknown, nowMs = Date.now()): number \| undefined {`
	`177`	`+const seconds = parseStrictPositiveInteger(expiresIn);`
	`178`	`+return seconds === undefined ? undefined : nowMs + seconds * 1000;`
	`179`	`+}`
	`180`	`+`
`175`	`181`	`function formatTokenRequestError(`
`176`	`182`	`operation: "exchange" \| "refresh",`
`177`	`183`	`error: unknown,`
`@@ -253,7 +259,8 @@ async function exchangeAuthorizationCode(`
`253`	`259`
`254`	`260`	`const json = (await response.json()) as TokenResponseJson;`
`255`	`261`
`256`		`-if (!json.access_token \|\| !json.refresh_token \|\| typeof json.expires_in !== "number") {`
	`262`	`+const expires = resolveTokenExpiresAt(json.expires_in);`
	`263`	`+if (!json.access_token \|\| !json.refresh_token \|\| expires === undefined) {`
`257`	`264`	`return {`
`258`	`265`	`type: "failed",`
`259`	`266`	message: `OpenAI Codex token exchange response missing fields: ${formatMissingTokenResponseFields(json)}`,
`@@ -264,7 +271,7 @@ async function exchangeAuthorizationCode(`
`264`	`271`	`type: "success",`
`265`	`272`	`access: json.access_token,`
`266`	`273`	`refresh: json.refresh_token,`
`267`		`-expires: Date.now() + json.expires_in * 1000,`
	`274`	`+ expires,`
`268`	`275`	`};`
`269`	`276`	`}`
`270`	`277`
`@@ -294,7 +301,8 @@ async function refreshAccessToken(`
`294`	`301`
`295`	`302`	`const json = (await response.json()) as TokenResponseJson;`
`296`	`303`
`297`		`-if (!json.access_token \|\| !json.refresh_token \|\| typeof json.expires_in !== "number") {`
	`304`	`+const expires = resolveTokenExpiresAt(json.expires_in);`
	`305`	`+if (!json.access_token \|\| !json.refresh_token \|\| expires === undefined) {`
`298`	`306`	`return {`
`299`	`307`	`type: "failed",`
`300`	`308`	message: `OpenAI Codex token refresh response missing fields: ${formatMissingTokenResponseFields(json)}`,
`@@ -305,7 +313,7 @@ async function refreshAccessToken(`
`305`	`313`	`type: "success",`
`306`	`314`	`access: json.access_token,`
`307`	`315`	`refresh: json.refresh_token,`
`308`		`-expires: Date.now() + json.expires_in * 1000,`
	`316`	`+ expires,`
`309`	`317`	`};`
`310`	`318`	`} catch (error) {`
`311`	`319`	`return {`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main