fix(plugin-sdk): bound live model catalog success body

Alix-007 · Alix-007 · commit 211e80e3814f · 2026-06-20T13:56:42.000+08:00
diff --git a/src/plugin-sdk/provider-catalog-live-runtime.test.ts b/src/plugin-sdk/provider-catalog-live-runtime.test.ts
@@ -157,6 +157,91 @@ describe("provider-catalog-live-runtime", () => {
     expect(fetchGuardMock).toHaveBeenCalledTimes(1);
   });
 
+  it("bounds an unbounded live catalog success stream and cancels the body", async () => {
+    const encoder = new TextEncoder();
+    let pullCount = 0;
+    let cancelled = false;
+    const release = vi.fn(async () => undefined);
+    const fetchGuardMock: MockedFunction<LiveModelCatalogFetchGuard> = vi.fn(async () => ({
+      response: new Response(
+        new ReadableStream<Uint8Array>({
+          pull(controller) {
+            pullCount += 1;
+            // Stream a JSON array prefix followed by an effectively endless run of
+            // padding so the body never terminates under its own power.
+            if (pullCount === 1) {
+              controller.enqueue(encoder.encode('[{"id":"model-a","object":"model"},'));
+              return;
+            }
+            controller.enqueue(encoder.encode("0".repeat(1024 * 1024)));
+          },
+          cancel() {
+            cancelled = true;
+          },
+        }),
+        { headers: { "content-type": "application/json" } },
+      ),
+      finalUrl: "https://provider.example.test/v1/models",
+      release,
+    }));
+
+    const error = await fetchLiveProviderModelIds({
+      providerId: "provider",
+      endpoint: "https://provider.example.test/v1/models",
+      fetchGuard: fetchGuardMock,
+    }).catch((err: unknown) => err);
+
+    expect(error).toBeInstanceOf(Error);
+    expect((error as Error).message).toMatch(/Live model catalog response exceeded \d+ bytes/);
+    expect(cancelled).toBe(true);
+    expect(release).toHaveBeenCalledTimes(1);
+  });
+
+  it("aborts a stalled live catalog success stream", async () => {
+    vi.useFakeTimers();
+    try {
+      const encoder = new TextEncoder();
+      let cancelReason: unknown;
+      const release = vi.fn(async () => undefined);
+      const fetchGuardMock: MockedFunction<LiveModelCatalogFetchGuard> = vi.fn(async () => ({
+        response: new Response(
+          new ReadableStream<Uint8Array>({
+            start(controller) {
+              // Emit a partial JSON prefix and then idle forever without closing.
+              controller.enqueue(encoder.encode('[{"id":"model-a",'));
+            },
+            cancel(reason) {
+              cancelReason = reason;
+            },
+          }),
+          { headers: { "content-type": "application/json" } },
+        ),
+        finalUrl: "https://provider.example.test/v1/models",
+        release,
+      }));
+
+      const resultPromise = fetchLiveProviderModelIds({
+        providerId: "provider",
+        endpoint: "https://provider.example.test/v1/models",
+        fetchGuard: fetchGuardMock,
+        timeoutMs: 1234,
+      }).catch((err: unknown) => err);
+
+      await vi.advanceTimersByTimeAsync(0);
+      await vi.advanceTimersByTimeAsync(1234);
+      const error = await resultPromise;
+
+      expect(error).toBeInstanceOf(Error);
+      expect((error as Error).message).toBe(
+        "Live model catalog response stalled: no data received for 1234ms",
+      );
+      expect(cancelReason).toBeInstanceOf(Error);
+      expect(release).toHaveBeenCalledTimes(1);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it("throws structured HTTP errors after releasing guarded fetches", async () => {
     const release = vi.fn(async () => undefined);
     const response = new Response("{}", { status: 401 });
diff --git a/src/plugin-sdk/provider-catalog-live-runtime.ts b/src/plugin-sdk/provider-catalog-live-runtime.ts
@@ -1,3 +1,4 @@
+import { readResponseWithLimit } from "@openclaw/media-core/read-response-with-limit";
 import { isNonSecretApiKeyMarker } from "../agents/model-auth-markers.js";
 import {
   clearLiveCatalogCacheForTests,
@@ -45,6 +46,15 @@ export type CachedLiveProviderModelRowsParams = FetchLiveProviderModelRowsParams
   shouldCacheRows?: (rows: readonly unknown[]) => boolean;
 };
 
+// Live model catalogs are fetched at runtime from provider-controlled endpoints,
+// so the success body is untrusted just like the error body. A faulty or hostile
+// provider can stream an unbounded JSON document; reading it without a ceiling
+// lets a single discovery call exhaust process memory. The cap is sized well
+// above the largest known catalog (OpenRouter's live catalog is already >100KB
+// and grows) while still bounding memory, mirroring the bounded-stream hardening
+// applied to error bodies in #95108.
+const LIVE_MODEL_CATALOG_BODY_MAX_BYTES = 4 * 1024 * 1024;
+
 export class LiveModelCatalogHttpError extends Error {
   readonly status: number;
 
@@ -133,17 +143,29 @@ async function cancelUnreadResponseBody(response: Response): Promise<void> {
   }
 }
 
+async function readLiveModelCatalogJson(response: Response, timeoutMs: number): Promise<unknown> {
+  const buffer = await readResponseWithLimit(response, LIVE_MODEL_CATALOG_BODY_MAX_BYTES, {
+    chunkTimeoutMs: timeoutMs,
+    onOverflow: ({ size, maxBytes }) =>
+      new Error(`Live model catalog response exceeded ${maxBytes} bytes (${size} bytes received)`),
+    onIdleTimeout: ({ chunkTimeoutMs }) =>
+      new Error(`Live model catalog response stalled: no data received for ${chunkTimeoutMs}ms`),
+  });
+  return JSON.parse(buffer.toString("utf8"));
+}
+
 export async function fetchLiveProviderModelRows(
   params: FetchLiveProviderModelRowsParams,
 ): Promise<readonly unknown[]> {
   const fetchGuard = params.fetchGuard ?? fetchWithSsrFGuard;
+  const timeoutMs = params.timeoutMs ?? 5_000;
   const { response, release } = await fetchGuard({
     url: params.endpoint,
     init: {
       headers: buildHeaders(params),
     },
     signal: params.signal,
-    timeoutMs: params.timeoutMs ?? 5_000,
+    timeoutMs,
     policy: params.policy ?? ssrfPolicyFromHttpBaseUrlAllowedHostname(params.endpoint),
     ...(params.lookupFn ? { lookupFn: params.lookupFn } : {}),
     ...(params.requireHttps !== undefined ? { requireHttps: params.requireHttps } : {}),
@@ -154,7 +176,9 @@ export async function fetchLiveProviderModelRows(
       await cancelUnreadResponseBody(response);
       throw new LiveModelCatalogHttpError(params.providerId, response.status);
     }
-    return (params.readRows ?? readDefaultLiveModelCatalogRows)(await response.json());
+    return (params.readRows ?? readDefaultLiveModelCatalogRows)(
+      await readLiveModelCatalogJson(response, timeoutMs),
+    );
   } finally {
     await release();
   }
