mirror of
https://github.com/openclaw/openclaw.git
synced 2026-07-23 11:41:10 +00:00
7cde0ac8c0
* fix(proxy-capture): guard body-less arrayBuffer reads against oversized responses * fix(proxy-capture): exercise body-less fallback in bounded read tests New tests use mock clones with body: null plus arrayBuffer spies to prove the content-length precheck guards the !body path. A real Response clone exposes body.getReader in Node 24, so the prior test only exercised the streaming branch and would stay green even if the precheck were deleted. * chore: retrigger CI * fix(proxy-capture): reject non-safe content-length before arrayBuffer (#101268) ClawSweeper P2: the body-less fallback used Number(content-length), so a huge digit-only Content-Length value could overflow to Infinity, bypass the Number.isFinite guard, and still call arrayBuffer() — leaving an OOM path in the hardening PR. Add declaredContentLengthExceedsCap, which accepts only plain digit strings, treats any value longer than Number.MAX_SAFE_INTEGER as oversized, and compares safe-integer parsed values against the cap. Non-numeric or malformed values fall through to the post-read length check. Adds a regression test for a 100-digit Content-Length that would previously have bypassed the guard. * fix(proxy-capture): normalize zero-padded Content-Length before digit-count guard * fix(proxy-capture): fail closed without response streams --------- Co-authored-by: Peter Steinberger <steipete@gmail.com>