Fix/discord bound probe getme json reads (#97278)

hugenshen · NIO · Peter Steinberger · web-flow · commit 7ba9212665a7 · 2026-06-28T01:57:20.000-07:00
* fix(discord): bound probe getMe JSON response reads

* test(discord): add oversized probe getMe JSON regression

* test(discord): add loopback proof for bounded probe getMe reads

* fix(scripts): satisfy oxlint in discord probe proof script

* test(discord): keep probe proof in focused coverage

---------

Co-authored-by: NIO &lt;nocodet@mail.com&gt;
Co-authored-by: Peter Steinberger &lt;steipete@golden-gate.local&gt;
diff --git a/extensions/discord/src/probe.intents.test.ts b/extensions/discord/src/probe.intents.test.ts
@@ -9,6 +9,28 @@ import {
 } from "./probe.js";
 import { jsonResponse } from "./test-http-helpers.js";
 
+const DISCORD_PROBE_JSON_CAP_BYTES = 16 * 1024 * 1024;
+
+function oversizedDiscordProbeJsonResponse(onCancel: () => void): Response {
+  const response = new Response(
+    new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new Uint8Array(DISCORD_PROBE_JSON_CAP_BYTES + 1));
+      },
+      cancel() {
+        onCancel();
+      },
+    }),
+    { headers: { "content-type": "application/json" }, status: 200 },
+  );
+  Object.defineProperty(response, "json", {
+    value: async () => {
+      throw new Error("unbounded json reader was used");
+    },
+  });
+  return response;
+}
+
 describe("resolveDiscordPrivilegedIntentsFromFlags", () => {
   beforeEach(() => {
     vi.useRealTimers();
@@ -104,6 +126,21 @@ describe("resolveDiscordPrivilegedIntentsFromFlags", () => {
     expect(cancel).toHaveBeenCalledTimes(1);
   });
 
+  it("bounds oversized getMe probe JSON responses and cancels the stream", async () => {
+    let cancelCount = 0;
+    const fetcher = withFetchPreconnect(async () =>
+      oversizedDiscordProbeJsonResponse(() => {
+        cancelCount += 1;
+      }),
+    );
+
+    await expect(probeDiscord("MTIz.abc.def", 1_000, { fetcher })).resolves.toMatchObject({
+      ok: false,
+      error: expect.stringContaining("discord.probe.getMe: JSON response exceeds 16777216 bytes"),
+    });
+    expect(cancelCount).toBe(1);
+  });
+
   it("derives application id from parseable tokens before probing REST", async () => {
     let calls = 0;
     const fetcher = withFetchPreconnect(async () => {
diff --git a/extensions/discord/src/probe.ts b/extensions/discord/src/probe.ts
@@ -2,6 +2,7 @@
 import type { BaseProbeResult } from "openclaw/plugin-sdk/channel-contract";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { resolveFetch } from "openclaw/plugin-sdk/fetch-runtime";
+import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
 import { fetchWithTimeout } from "openclaw/plugin-sdk/text-utility-runtime";
 import { DiscordApiError, fetchDiscord } from "./api.js";
 import { normalizeDiscordToken } from "./token.js";
@@ -155,7 +156,10 @@ export async function probeDiscord(
       result.error = `getMe failed (${res.status})`;
       return { ...result, elapsedMs: Date.now() - started };
     }
-    const json = (await res.json()) as { id?: string; username?: string };
+    const json = await readProviderJsonResponse<{ id?: string; username?: string }>(
+      res,
+      "discord.probe.getMe",
+    );
     result.ok = true;
     result.bot = {
       id: json.id ?? null,
