fix(scripts): reject unsafe package download lengths

vincentkoc · web-flow · commit bb1043b14c46 · 2026-06-20T03:36:12.000+08:00
Reject unsafe decimal package_url Content-Length values before streaming response bodies.\n\nValidation:\n- node --check scripts/resolve-openclaw-package-candidate.mjs\n- direct injected downloadUrl repro for unsafe Content-Length\n- git diff --check origin/main...HEAD\n- autoreview clean, overall patch correct 0.9\n- exact-head release gate https://github.com/openclaw/openclaw/actions/runs/27844538401
diff --git a/scripts/resolve-openclaw-package-candidate.mjs b/scripts/resolve-openclaw-package-candidate.mjs
@@ -1209,7 +1209,10 @@ export async function downloadUrl(url, target, options = {}) {
     const rawContentLength = responseHeader(response, "content-length");
     const contentLength =
       rawContentLength && /^\d+$/u.test(rawContentLength) ? Number(rawContentLength) : undefined;
-    if (Number.isSafeInteger(contentLength) && contentLength > maxBytes) {
+    if (
+      contentLength !== undefined &&
+      (!Number.isSafeInteger(contentLength) || contentLength > maxBytes)
+    ) {
       throw new Error(`package_url exceeds maximum download size of ${maxBytes} bytes`);
     }
     await fs.rm(tempTarget, { force: true });
diff --git a/test/scripts/resolve-openclaw-package-candidate.test.ts b/test/scripts/resolve-openclaw-package-candidate.test.ts
@@ -726,6 +726,50 @@ describe("resolve-openclaw-package-candidate", () => {
     expect(bodyCancelled).toBe(true);
   });
 
+  it("rejects unsafe decimal package_url content-length values before reading", async () => {
+    const dir = await mkdtemp(path.join(tmpdir(), "openclaw-package-download-"));
+    tempDirs.push(dir);
+    const target = path.join(dir, "openclaw.tgz");
+    let readStarted = false;
+    let bodyCancelled = false;
+
+    await expect(
+      downloadUrl("https://packages.example/openclaw.tgz", target, {
+        fetchImpl: async () =>
+          ({
+            body: {
+              cancel() {
+                bodyCancelled = true;
+                return Promise.resolve();
+              },
+              getReader() {
+                return {
+                  cancel() {
+                    bodyCancelled = true;
+                    return Promise.resolve();
+                  },
+                  read() {
+                    readStarted = true;
+                    return new Promise(() => {});
+                  },
+                  releaseLock() {},
+                };
+              },
+            },
+            headers: new Headers({ "content-length": "9007199254740993" }),
+            status: 200,
+          }) as Response,
+        lookupHost: lookupAddresses([{ address: "93.184.216.34", family: 4 }]),
+        maxBytes: 1024,
+        timeoutMs: 25,
+      }),
+    ).rejects.toThrow(/exceeds maximum download size/u);
+    expect(readStarted).toBe(false);
+    expect(bodyCancelled).toBe(true);
+    await expect(missing(target)).resolves.toBe(true);
+    await expect(missing(`${target}.tmp`)).resolves.toBe(true);
+  });
+
   it("bounds package_url downloads and writes completed files atomically", async () => {
     const dir = await mkdtemp(path.join(tmpdir(), "openclaw-package-download-"));
     tempDirs.push(dir);
