fix(tool-payload): enforce UTF-8 byte limits for serialized payloads (#102450)

qingminglong · steipete · web-flow · commit b20b02a47633 · 2026-07-09T07:47:23.000+01:00
* fix(tool-payload): reject oversized XML payload bytes

* fix(tools): enforce serialized payload byte limits

---------

Co-authored-by: Peter Steinberger &lt;steipete@gmail.com&gt;
diff --git a/packages/tool-call-repair/src/payload.ts b/packages/tool-call-repair/src/payload.ts
@@ -29,11 +29,25 @@ export type PlainTextToolCallBlock = {
 export type PlainTextToolCallParseOptions = {
   /** Optional allowlist of tool names that may be repaired. */
   allowedToolNames?: Iterable<string>;
-  /** Maximum JSON payload size accepted for one repaired call. */
+  /** Maximum serialized payload size accepted for one repaired call. */
   maxPayloadBytes?: number;
 };
 
 const DEFAULT_MAX_PLAIN_TEXT_TOOL_PAYLOAD_BYTES = 256_000;
+const utf8Encoder = new TextEncoder();
+
+function utf8ByteLengthWithinLimit(
+  text: string,
+  start: number,
+  end: number,
+  maxBytes: number,
+): number | null {
+  if (end - start > maxBytes) {
+    return null;
+  }
+  const byteLength = utf8Encoder.encode(text.slice(start, end)).byteLength;
+  return byteLength <= maxBytes ? byteLength : null;
+}
 
 type PlainTextToolCallOpening = {
   allowsOptionalXmlishClose?: boolean;
@@ -140,7 +154,7 @@ function consumeJsonObject(
     return null;
   }
   const end = findJsonObjectEnd(text, cursor, maxPayloadBytes);
-  if (end === null) {
+  if (end === null || utf8ByteLengthWithinLimit(text, cursor, end, maxPayloadBytes) === null) {
     return null;
   }
   const rawJson = text.slice(cursor, end);
@@ -247,15 +261,17 @@ function consumeXmlishParameterBlock(
   text: string,
   start: number,
   maxPayloadBytes: number,
-): { end: number; name: string; value: string } | null {
+): { byteLength: number; end: number; name: string; value: string } | null {
   const bounds = findXmlishParameterBlock(text, start);
   if (!bounds) {
     return null;
   }
-  if (bounds.end - bounds.start > maxPayloadBytes) {
+  const byteLength = utf8ByteLengthWithinLimit(text, start, bounds.end, maxPayloadBytes);
+  if (byteLength === null) {
     return null;
   }
   return {
+    byteLength,
     end: bounds.end,
     name: bounds.name,
     value: extractXmlishParameterValue(text, bounds.payloadStart, bounds.closeStart),
@@ -339,12 +355,14 @@ function parseXmlishPlainTextToolCallBlockAt(
   const args: Record<string, unknown> = {};
   let cursor = opening.end;
   let parameterCount = 0;
+  let payloadBytes = 0;
   while (true) {
     const parameter = consumeXmlishParameterBlock(text, cursor, maxPayloadBytes);
     if (!parameter) {
       break;
     }
-    if (parameter.end - opening.end > maxPayloadBytes) {
+    payloadBytes += parameter.byteLength;
+    if (payloadBytes > maxPayloadBytes) {
       return null;
     }
     args[parameter.name] = parameter.value;
diff --git a/src/plugin-sdk/tool-payload.test.ts b/src/plugin-sdk/tool-payload.test.ts
@@ -242,6 +242,34 @@ describe("parseStandalonePlainTextToolCallBlocks", () => {
     ).toBeNull();
   });
 
+  it("counts serialized XML parameter payload limits in UTF-8 bytes", () => {
+    const parameter = ["<parameter=content>", "é".repeat(20), "</parameter>"].join("\n");
+    const raw = ["<function=write>", parameter, "</function>"].join("\n");
+    expect(parameter.length).toBeLessThan(64);
+    expect(new TextEncoder().encode(parameter).byteLength).toBeGreaterThan(64);
+
+    expect(
+      parseStandalonePlainTextToolCallBlocks(raw, {
+        allowedToolNames: ["write"],
+        maxPayloadBytes: 64,
+      }),
+    ).toBeNull();
+  });
+
+  it("counts serialized JSON payload limits in UTF-8 bytes", () => {
+    const payload = JSON.stringify({ content: "é".repeat(20) });
+    const raw = ["[write]", payload, "[/write]"].join("\n");
+    expect(payload.length).toBeLessThan(48);
+    expect(new TextEncoder().encode(payload).byteLength).toBeGreaterThan(48);
+
+    expect(
+      parseStandalonePlainTextToolCallBlocks(raw, {
+        allowedToolNames: ["write"],
+        maxPayloadBytes: 48,
+      }),
+    ).toBeNull();
+  });
+
   it("respects allowed tool names for Harmony calls", () => {
     const blocks = parseStandalonePlainTextToolCallBlocks(
       'commentary to=write code {"path":"/tmp/file.txt","content":"x"}',
diff --git a/src/plugin-sdk/tool-payload.ts b/src/plugin-sdk/tool-payload.ts
@@ -22,7 +22,7 @@ export type PlainTextToolCallBlock = {
 export type PlainTextToolCallParseOptions = {
   /** Optional allowlist of tool names that may be accepted. */
   allowedToolNames?: Iterable<string>;
-  /** Maximum JSON payload size accepted for one parsed call. */
+  /** Maximum serialized payload size accepted for one parsed call. */
   maxPayloadBytes?: number;
 };
 
