fix(browser): validate response body numeric options

steipete · steipete · commit 854cb9292db8 · 2026-05-29T03:27:34.000-04:00
diff --git a/extensions/browser/src/browser/routes/agent.act.ts b/extensions/browser/src/browser/routes/agent.act.ts
@@ -1,3 +1,4 @@
+import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import { formatErrorMessage } from "../../infra/errors.js";
 import {
   clickChromeMcpElement,
@@ -41,7 +42,7 @@ import {
 import { resolveTargetIdAfterNavigate } from "./agent.snapshot-target.js";
 import { EXISTING_SESSION_LIMITS } from "./existing-session-limits.js";
 import type { BrowserRouteRegistrar } from "./types.js";
-import { asyncBrowserRoute, jsonError, toNumber, toStringOrEmpty } from "./utils.js";
+import { asyncBrowserRoute, jsonError, toStringOrEmpty } from "./utils.js";
 
 function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -347,6 +348,14 @@ function getExistingSessionUnsupportedMessage(action: BrowserActRequest): string
   throw new Error("Unsupported browser act kind");
 }
 
+function readRoutePositiveInteger(value: unknown, fieldName: string): number | undefined {
+  const parsed = parseStrictPositiveInteger(value);
+  if (parsed === undefined && value != null) {
+    throw new Error(`${fieldName} must be a positive integer.`);
+  }
+  return parsed;
+}
+
 export function registerBrowserAgentActRoutes(
   app: BrowserRouteRegistrar,
   ctx: BrowserRouteContext,
@@ -697,8 +706,14 @@ export function registerBrowserAgentActRoutes(
       const body = readBody(req);
       const targetId = resolveTargetIdFromBody(body);
       const url = toStringOrEmpty(body.url);
-      const timeoutMs = toNumber(body.timeoutMs);
-      const maxChars = toNumber(body.maxChars);
+      let timeoutMs: number | undefined;
+      let maxChars: number | undefined;
+      try {
+        timeoutMs = readRoutePositiveInteger(body.timeoutMs, "timeoutMs");
+        maxChars = readRoutePositiveInteger(body.maxChars, "maxChars");
+      } catch (err) {
+        return jsonError(res, 400, formatErrorMessage(err));
+      }
       if (!url) {
         return jsonError(res, 400, "url is required");
       }
diff --git a/extensions/browser/src/browser/server.agent-contract-form-layout-act-commands.test.ts b/extensions/browser/src/browser/server.agent-contract-form-layout-act-commands.test.ts
@@ -453,6 +453,25 @@ describe("browser control server", () => {
     slowTimeoutMs,
   );
 
+  it("rejects loose response body numeric options before dispatch", async () => {
+    const base = await startServerAndBase();
+    const beforeCalls = pwMocks.responseBodyViaPlaywright.mock.calls.length;
+
+    const timeoutRes = await postJson<{ error?: string }>(`${base}/response/body`, {
+      url: "**/api/data",
+      timeoutMs: "1e3",
+    });
+    expect(timeoutRes.error).toContain("timeoutMs must be a positive integer.");
+
+    const maxCharsRes = await postJson<{ error?: string }>(`${base}/response/body`, {
+      url: "**/api/data",
+      maxChars: "0x10",
+    });
+    expect(maxCharsRes.error).toContain("maxChars must be a positive integer.");
+
+    expect(pwMocks.responseBodyViaPlaywright).toHaveBeenCalledTimes(beforeCalls);
+  });
+
   it("agent contract: hooks + response + downloads + screenshot", async () => {
     const base = await startServerAndBase();
 
