mirror of
https://github.com/openclaw/openclaw.git
synced 2026-06-23 16:18:09 +00:00
Reject unsafe decimal Content-Length values in the E2E bounded response text helper before streaming response bodies. Keep non-decimal values on the streaming byte-limit path and add regression coverage proving unsafe declared lengths cancel without starting a read. Proof: direct patched repro rejects before reading with code ETOOBIG; origin/main comparison entered the reader first; node --check scripts/e2e/lib/bounded-response-text.mjs; git diff --check origin/main...HEAD; autoreview clean overall 0.86; exact-head release gate succeeded at https://github.com/openclaw/openclaw/actions/runs/27846197115.
147 lines
3.9 KiB
TypeScript
147 lines
3.9 KiB
TypeScript
// E2E bounded response text tests cover shared E2E HTTP body limits.
|
|
import { describe, expect, it } from "vitest";
|
|
import { readBoundedResponseText } from "../../scripts/e2e/lib/bounded-response-text.mjs";
|
|
|
|
describe("scripts/e2e/lib/bounded-response-text.mjs", () => {
|
|
it("cancels pending response body reads when the timeout wins", async () => {
|
|
let canceled = false;
|
|
const response = {
|
|
headers: new Headers(),
|
|
body: {
|
|
getReader() {
|
|
return {
|
|
read() {
|
|
return new Promise<ReadableStreamReadResult<Uint8Array>>(() => {});
|
|
},
|
|
async cancel() {
|
|
canceled = true;
|
|
},
|
|
releaseLock() {
|
|
throw new Error("releaseLock should not run while a read is pending");
|
|
},
|
|
};
|
|
},
|
|
},
|
|
};
|
|
|
|
await expect(
|
|
readBoundedResponseText(
|
|
response,
|
|
"probe",
|
|
1024,
|
|
Promise.reject(new Error("probe timed out")),
|
|
),
|
|
).rejects.toThrow("probe timed out");
|
|
|
|
expect(canceled).toBe(true);
|
|
});
|
|
|
|
it("keeps timeout rejection ahead of cancel-unblocked stream reads", async () => {
|
|
let canceled = false;
|
|
const response = new Response(
|
|
new ReadableStream({
|
|
pull() {
|
|
return new Promise(() => {});
|
|
},
|
|
cancel() {
|
|
canceled = true;
|
|
},
|
|
}),
|
|
{ headers: new Headers() },
|
|
);
|
|
|
|
await expect(
|
|
readBoundedResponseText(
|
|
response,
|
|
"probe",
|
|
1024,
|
|
Promise.reject(new Error("probe timed out")),
|
|
),
|
|
).rejects.toThrow("probe timed out");
|
|
|
|
expect(canceled).toBe(true);
|
|
});
|
|
|
|
it("cancels oversized streamed response bodies", async () => {
|
|
let canceled = false;
|
|
const response = new Response(
|
|
new ReadableStream({
|
|
start(controller) {
|
|
controller.enqueue(new Uint8Array(17));
|
|
},
|
|
cancel() {
|
|
canceled = true;
|
|
},
|
|
}),
|
|
{ headers: new Headers() },
|
|
);
|
|
|
|
await expect(readBoundedResponseText(response, "probe", 16)).rejects.toMatchObject({
|
|
code: "ETOOBIG",
|
|
message: "probe response body exceeded 16 bytes",
|
|
});
|
|
expect(canceled).toBe(true);
|
|
});
|
|
|
|
it("streams responses with non-decimal content-length values", async () => {
|
|
let readStarted = false;
|
|
let canceled = false;
|
|
const response = {
|
|
headers: new Headers({ "content-length": "1e3" }),
|
|
body: {
|
|
getReader() {
|
|
return {
|
|
async read() {
|
|
readStarted = true;
|
|
return { done: false, value: new Uint8Array(17) };
|
|
},
|
|
async cancel() {
|
|
canceled = true;
|
|
},
|
|
releaseLock() {},
|
|
};
|
|
},
|
|
},
|
|
};
|
|
|
|
await expect(readBoundedResponseText(response, "probe", 16)).rejects.toMatchObject({
|
|
code: "ETOOBIG",
|
|
message: "probe response body exceeded 16 bytes",
|
|
});
|
|
expect(readStarted).toBe(true);
|
|
expect(canceled).toBe(true);
|
|
});
|
|
|
|
it("rejects unsafe decimal content-length values before reading", async () => {
|
|
let readStarted = false;
|
|
let canceled = false;
|
|
const response = {
|
|
headers: new Headers({ "content-length": "9007199254740993" }),
|
|
body: {
|
|
async cancel() {
|
|
canceled = true;
|
|
},
|
|
getReader() {
|
|
return {
|
|
async read() {
|
|
readStarted = true;
|
|
return new Promise<ReadableStreamReadResult<Uint8Array>>(() => {});
|
|
},
|
|
async cancel() {
|
|
canceled = true;
|
|
},
|
|
releaseLock() {},
|
|
};
|
|
},
|
|
},
|
|
};
|
|
|
|
await expect(readBoundedResponseText(response, "probe", 16)).rejects.toMatchObject({
|
|
code: "ETOOBIG",
|
|
message: "probe response body exceeded 16 bytes",
|
|
});
|
|
expect(readStarted).toBe(false);
|
|
expect(canceled).toBe(true);
|
|
});
|
|
});
|