fix(minimax): bound OAuth JSON response via shared provider reader

lsr911 · claude · lsr911 · commit bca97f3e1607 · 2026-06-27T14:03:36.000+08:00
Use readProviderJsonResponse (shared 16 MiB default cap) instead of
unbounded response.json() for MiniMax OAuth authorization code endpoint.

Co-Authored-By: Claude &lt;noreply@anthropic.com&gt;
Signed-off-by: lsr911 &lt;liao.shirong@xydigit.com&gt;
diff --git a/extensions/minimax/oauth.ts b/extensions/minimax/oauth.ts
@@ -7,7 +7,10 @@ import {
   resolvePositiveTimerTimeoutMs,
 } from "openclaw/plugin-sdk/number-runtime";
 import { generatePkceVerifierChallenge, toFormUrlEncoded } from "openclaw/plugin-sdk/provider-auth";
-import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
+import {
+  readProviderJsonResponse,
+  readResponseTextLimited,
+} from "openclaw/plugin-sdk/provider-http";
 import { ensureGlobalUndiciEnvProxyDispatcher } from "openclaw/plugin-sdk/runtime-env";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 
@@ -121,7 +124,10 @@ async function requestOAuthCode(params: {
       throw new Error(`MiniMax OAuth authorization failed: ${text || response.statusText}`);
     }
 
-    const payload = (await response.json()) as MiniMaxOAuthAuthorization & { error?: string };
+    const payload = (await readProviderJsonResponse(
+      response,
+      "minimax.oauth-code",
+    )) as MiniMaxOAuthAuthorization & { error?: string };
     if (!payload.user_code || !payload.verification_uri) {
       throw new Error(
         payload.error ??
