fix: bound miscellaneous unbounded file reads across 5 modules (#110516)

cxbAsDev · steipete · web-flow · commit 2295fae731fd · 2026-07-18T23:27:26.000+01:00
* fix: bound misc unbounded fs.readFile calls; remove unused fs import

* fix: decode buffer to string before passing to string consumers

readRegularFile and readRegularFileSync return { buffer, stat },
not a string. All 4 new call sites passed the raw object to functions
expecting a string (JSON.parse, RegExp.test, template literals, etc.),
causing TS2345 type errors and runtime failures.

Fix each call by extracting .buffer and calling .toString('utf8')
before passing the result to string consumers.

* style: fix oxfmt formatting in config-set-input.ts

* fix: bound config and trajectory metadata reads

Co-authored-by: 陈宪彪0668000387 &lt;chen.xianbiao@xydigit.com&gt;

* refactor: isolate bounded read ownership

Co-authored-by: 陈宪彪0668000387 &lt;chen.xianbiao@xydigit.com&gt;

---------

Co-authored-by: Peter Steinberger &lt;steipete@gmail.com&gt;
diff --git a/docs/cli/config.md b/docs/cli/config.md
@@ -177,6 +177,8 @@ Use `--replace` only when the provided value should intentionally become the com
     openclaw config set --batch-file ./config-set.batch.json --dry-run
     ```
 
+    Batch files are limited to 8 MiB.
+
   </Tab>
 </Tabs>
 
@@ -257,6 +259,8 @@ openclaw config patch --file ./openclaw.patch.json5 --dry-run
 openclaw config patch --file ./openclaw.patch.json5
 ```
 
+Patch files are limited to 8 MiB. Piped `--stdin` patches are limited to 1 MiB.
+
 Pipe a patch over stdin for remote setup scripts:
 
 ```bash
diff --git a/src/cli/config-cli.test.ts b/src/cli/config-cli.test.ts
@@ -2424,6 +2424,24 @@ describe("config cli", () => {
       expect(mockWriteConfigFile).not.toHaveBeenCalled();
     });
 
+    it("rejects --file patches above the config mutation limit", async () => {
+      const pathname = path.join(
+        os.tmpdir(),
+        `openclaw-config-patch-oversized-${Date.now()}-${Math.random().toString(16).slice(2)}.json5`,
+      );
+      fs.writeFileSync(pathname, " ".repeat(8 * 1024 * 1024 + 1), "utf8");
+      try {
+        await expect(runConfigCommand(["config", "patch", "--file", pathname])).rejects.toThrow(
+          ExitError,
+        );
+      } finally {
+        fs.rmSync(pathname, { force: true });
+      }
+
+      expectErrorIncludes("File exceeds 8388608 bytes");
+      expect(mockWriteConfigFile).not.toHaveBeenCalled();
+    });
+
     it("dry-runs pluginIntegration provider patches against manifest integration metadata", async () => {
       const pluginId = "secret-provider-proof";
       const rootDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-config-plugin-provider-"));
diff --git a/src/cli/config-cli.ts b/src/cli/config-cli.ts
@@ -1,5 +1,4 @@
 // Config CLI command implementation for get/set/unset/patch/validate and secret refs.
-import fs from "node:fs";
 import { readByteStreamWithLimit } from "@openclaw/media-core/read-byte-stream-with-limit";
 import { expectDefined } from "@openclaw/normalization-core";
 import { isRecord as isPlainRecord } from "@openclaw/normalization-core/record-coerce";
@@ -85,6 +84,7 @@ import {
   hasProviderBuilderOptions,
   hasRefBuilderOptions,
   parseBatchSource,
+  readConfigMutationFileSync,
   type ConfigSetBatchEntry,
   type ConfigSetOptions,
 } from "./config-set-input.js";
@@ -1507,7 +1507,7 @@ async function readConfigPatchInput(opts: ConfigPatchOptions): Promise<unknown>
     raw = await readStdinText();
   } else {
     try {
-      raw = fs.readFileSync(file as string, "utf8");
+      raw = readConfigMutationFileSync(file as string);
     } catch (err) {
       if (hasErrnoCode(err, "ENOENT")) {
         throw new Error(`--file not found: ${file}`, { cause: err });
diff --git a/src/cli/config-set-input.test.ts b/src/cli/config-set-input.test.ts
@@ -113,4 +113,16 @@ describe("config set input parsing", () => {
       ).toThrow("--batch-file must be a JSON array.");
     });
   });
+
+  it("rejects --batch-file payloads above the config mutation limit", () => {
+    withBatchFile(
+      "openclaw-config-set-input-oversized-",
+      " ".repeat(8 * 1024 * 1024 + 1),
+      (batchPath) => {
+        expect(() => parseBatchSource({ batchFile: batchPath })).toThrow(
+          "File exceeds 8388608 bytes",
+        );
+      },
+    );
+  });
 });
diff --git a/src/cli/config-set-input.ts b/src/cli/config-set-input.ts
@@ -6,6 +6,7 @@ import {
 } from "@openclaw/normalization-core/string-coerce";
 import JSON5 from "json5";
 import { hasErrnoCode } from "../infra/errors.js";
+import { readFileDescriptorBoundedSync } from "../infra/file-descriptor-read.js";
 
 export type ConfigSetOptions = {
   strictJson?: boolean;
@@ -45,6 +46,19 @@ export type ConfigSetBatchEntry = {
   provider?: unknown;
 };
 
+const CONFIG_MUTATION_FILE_MAX_BYTES = 8 * 1024 * 1024;
+
+export function readConfigMutationFileSync(filePath: string): string {
+  // These explicit CLI file flags have historically followed user-provided
+  // symlinks. Pin the opened descriptor, then bound the read without changing that contract.
+  const fd = fs.openSync(filePath, "r");
+  try {
+    return readFileDescriptorBoundedSync(fd, CONFIG_MUTATION_FILE_MAX_BYTES).toString("utf8");
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
 export function hasBatchMode(opts: ConfigSetOptions): boolean {
   return Boolean(
     normalizeOptionalString(opts.batchJson) || normalizeOptionalString(opts.batchFile),
@@ -139,7 +153,7 @@ export function parseBatchSource(opts: ConfigSetOptions): ConfigSetBatchEntry[]
   }
   let raw: string;
   try {
-    raw = fs.readFileSync(pathname, "utf8");
+    raw = readConfigMutationFileSync(pathname);
   } catch (err) {
     if (hasErrnoCode(err, "ENOENT")) {
       throw new Error(`--batch-file not found: ${pathname}`, { cause: err });
diff --git a/src/trajectory/cleanup.test.ts b/src/trajectory/cleanup.test.ts
@@ -170,4 +170,34 @@ describe("trajectory cleanup", () => {
       expect((await fs.stat(unsafeExternalRuntime)).isFile()).toBe(true);
     });
   });
+
+  it("ignores oversized trajectory pointers while still removing the sidecar", async () => {
+    await withTempDir({ prefix: "openclaw-trajectory-cleanup-" }, async (dir) => {
+      const sessionId = "session-oversized-pointer";
+      const sessionsDir = path.join(dir, "sessions");
+      const storePath = path.join(sessionsDir, "sessions.json");
+      const sessionFile = path.join(sessionsDir, `${sessionId}.jsonl`);
+      const externalRuntime = path.join(dir, "external", `${sessionId}.jsonl`);
+      const pointerPath = resolveTrajectoryPointerFilePath(sessionFile);
+      await fs.mkdir(sessionsDir, { recursive: true });
+      await fs.mkdir(path.dirname(externalRuntime), { recursive: true });
+      await fs.writeFile(externalRuntime, runtimeEvent(sessionId), "utf8");
+      await fs.writeFile(
+        pointerPath,
+        `${pointerFile(sessionId, externalRuntime)}${" ".repeat(64 * 1024)}`,
+        "utf8",
+      );
+
+      const removed = await removeSessionTrajectoryArtifacts({
+        sessionId,
+        sessionFile,
+        storePath,
+        restrictToStoreDir: true,
+      });
+
+      expect(removed).toEqual([{ kind: "pointer", path: pointerPath }]);
+      expect((await fs.stat(externalRuntime)).isFile()).toBe(true);
+      await expectPathMissing(pointerPath);
+    });
+  });
 });
diff --git a/src/trajectory/cleanup.ts b/src/trajectory/cleanup.ts
@@ -6,7 +6,9 @@ import { resolveSessionFilePath } from "../config/sessions/paths.js";
 import { parseSqliteSessionFileMarker } from "../config/sessions/sqlite-marker.js";
 import { readFileWindowFullySync } from "../infra/file-read.js";
 import { isPathInside } from "../infra/path-guards.js";
+import { readRegularFileSync } from "../infra/regular-file.js";
 import {
+  TRAJECTORY_POINTER_FILE_MAX_BYTES,
   resolveTrajectoryFilePath,
   resolveTrajectoryPointerFilePath,
   safeTrajectorySessionFileName,
@@ -52,11 +54,12 @@ function readTrajectoryPointerFile(
   pointerPath: string,
   sessionId: string,
 ): TrajectoryPointer | null {
-  if (!isRegularNonSymlinkFile(pointerPath)) {
-    return null;
-  }
   try {
-    const parsed: unknown = JSON.parse(fs.readFileSync(pointerPath, "utf8"));
+    const { buffer } = readRegularFileSync({
+      filePath: pointerPath,
+      maxBytes: TRAJECTORY_POINTER_FILE_MAX_BYTES,
+    });
+    const parsed: unknown = JSON.parse(buffer.toString("utf8"));
     if (!isRecord(parsed)) {
       return null;
     }
diff --git a/src/trajectory/export.test.ts b/src/trajectory/export.test.ts
@@ -10,7 +10,12 @@ import { formatSqliteSessionFileMarker } from "../config/sessions/sqlite-marker.
 import { closeOpenClawAgentDatabasesForTest } from "../state/openclaw-agent-db.js";
 import { closeOpenClawStateDatabaseForTest } from "../state/openclaw-state-db.js";
 import { exportTrajectoryBundle, resolveDefaultTrajectoryExportDir } from "./export.js";
-import { TRAJECTORY_RUNTIME_FILE_MAX_BYTES, resolveTrajectoryPointerFilePath } from "./paths.js";
+import {
+  TRAJECTORY_POINTER_FILE_MAX_BYTES,
+  TRAJECTORY_RUNTIME_FILE_MAX_BYTES,
+  resolveTrajectoryFilePath,
+  resolveTrajectoryPointerFilePath,
+} from "./paths.js";
 import { appendSqliteTrajectoryRuntimeEvents } from "./runtime-store.sqlite.js";
 import type { TrajectoryEvent } from "./types.js";
 
@@ -1307,6 +1312,53 @@ describe("exportTrajectoryBundle", () => {
     expect(eventTypes(bundle.events)).not.toContain("outside-runtime");
   });
 
+  it("ignores oversized runtime pointers and falls back to the default trajectory file", async () => {
+    const tmpDir = makeTempDir();
+    const sessionFile = path.join(tmpDir, "session.jsonl");
+    const defaultRuntimeFile = resolveTrajectoryFilePath({
+      env: {},
+      sessionFile,
+      sessionId: "session-1",
+    });
+    const outputDir = path.join(tmpDir, "bundle");
+    writeSimpleSessionFile(sessionFile);
+    fs.writeFileSync(
+      resolveTrajectoryPointerFilePath(sessionFile),
+      `${JSON.stringify({
+        traceSchema: "openclaw-trajectory-pointer",
+        schemaVersion: 1,
+        sessionId: "session-1",
+        runtimeFile: path.join(tmpDir, "recorded", "session-1.jsonl"),
+      })}\n${" ".repeat(TRAJECTORY_POINTER_FILE_MAX_BYTES)}`,
+      "utf8",
+    );
+    fs.writeFileSync(
+      defaultRuntimeFile,
+      `${JSON.stringify({
+        traceSchema: "openclaw-trajectory",
+        schemaVersion: 1,
+        traceId: "session-1",
+        source: "runtime",
+        type: "default-runtime",
+        ts: "2026-04-22T08:00:00.000Z",
+        seq: 1,
+        sourceSeq: 1,
+        sessionId: "session-1",
+      })}\n`,
+      "utf8",
+    );
+
+    const bundle = await exportTrajectoryBundle({
+      outputDir,
+      sessionFile,
+      sessionId: "session-1",
+      workspaceDir: tmpDir,
+    });
+
+    expect(bundle.runtimeFile).toBe(defaultRuntimeFile);
+    expect(eventTypes(bundle.events)).toContain("default-runtime");
+  });
+
   it("does not fall back to runtime pointer targets that are not regular files", async () => {
     const tmpDir = makeTempDir();
     const sessionFile = path.join(tmpDir, "session.jsonl");
diff --git a/src/trajectory/paths.ts b/src/trajectory/paths.ts
@@ -10,6 +10,8 @@ import { isPathInside } from "../infra/path-guards.js";
 export const TRAJECTORY_RUNTIME_CAPTURE_MAX_BYTES = 10 * 1024 * 1024;
 export const TRAJECTORY_RUNTIME_FILE_MAX_BYTES = 50 * 1024 * 1024;
 export const TRAJECTORY_RUNTIME_EVENT_MAX_BYTES = 256 * 1024;
+// Pointer JSON only records schema metadata and one runtime path.
+export const TRAJECTORY_POINTER_FILE_MAX_BYTES = 64 * 1024;
 
 export function safeTrajectorySessionFileName(sessionId: string): string {
   const safe = sessionId.replaceAll(/[^A-Za-z0-9_-]/g, "_").slice(0, 120);
diff --git a/src/trajectory/runtime-file.ts b/src/trajectory/runtime-file.ts
@@ -2,7 +2,9 @@
 import fsp from "node:fs/promises";
 import path from "node:path";
 import { isRecord } from "@openclaw/normalization-core/record-coerce";
+import { readRegularFile } from "../infra/regular-file.js";
 import {
+  TRAJECTORY_POINTER_FILE_MAX_BYTES,
   resolveTrajectoryFilePath,
   resolveTrajectoryPointerFilePath,
   safeTrajectorySessionFileName,
@@ -28,11 +30,12 @@ async function readRuntimePointerFile(
   sessionId: string,
 ): Promise<string | undefined> {
   const pointerPath = resolveTrajectoryPointerFilePath(sessionFile);
-  if (!(await isRegularNonSymlinkFile(pointerPath))) {
-    return undefined;
-  }
   try {
-    const parsed = JSON.parse(await fsp.readFile(pointerPath, "utf8")) as unknown;
+    const { buffer } = await readRegularFile({
+      filePath: pointerPath,
+      maxBytes: TRAJECTORY_POINTER_FILE_MAX_BYTES,
+    });
+    const parsed = JSON.parse(buffer.toString("utf8")) as unknown;
     if (!isRecord(parsed)) {
       return undefined;
     }
