sheyanmin e57acb1d94 fix(tools-manager): bound GitHub releases response body to prevent unbounded read (#98480) ...

* fix(tools-manager): bound GitHub releases response body to prevent unbounded read

The agent helper-tool fallback for fd and ripgrep read GitHub's
latest-release response with Response.json(). That consumes the
complete remote body before parsing it, so a faulty or compromised
response could grow agent memory without a bound.

This change makes the release-metadata fetch use the shared
readResponseWithLimit helper with a 1 MiB cap.

Ref. https://github.com/openclaw/openclaw/pull/98480

* fix(tools-manager): use bounded release reader

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>

2026-07-18 02:22:49 +01:00

..

frontmatter.ts

…

fs-watch.ts

…

git.test.ts

fix(agents): normalize git package identities

2026-07-14 08:55:08 -07:00

git.ts

fix(agents): normalize git package identities

2026-07-14 08:55:08 -07:00

image-resize.test.ts

refactor(agents): simplify image resize policy (#107027)

2026-07-14 10:46:01 +08:00

image-resize.ts

refactor(agents): simplify image resize policy (#107027)

2026-07-14 10:46:01 +08:00

mime.ts

…

paths.ts

…

sleep.test.ts

…

sleep.ts

…

syntax-highlight.test.ts

…

syntax-highlight.ts

refactor(html): share entity decoding

2026-07-14 00:00:05 -07:00

tools-manager.test-support.ts

refactor: eliminate dead-export baseline (#108376)

2026-07-15 17:05:07 +01:00

tools-manager.test.ts

fix(tools-manager): bound GitHub releases response body to prevent unbounded read (#98480)

2026-07-18 02:22:49 +01:00

tools-manager.ts

fix(tools-manager): bound GitHub releases response body to prevent unbounded read (#98480)

2026-07-18 02:22:49 +01:00