fix(signal): validate release metadata before install

Alix-007 · Leon-SK668 · commit e949737527b9 · 2026-07-20T12:06:48.000+08:00
diff --git a/extensions/signal/src/install-signal-cli.test.ts b/extensions/signal/src/install-signal-cli.test.ts
@@ -390,6 +390,26 @@ describe("installSignalCliFromRelease", () => {
     expect(fetchResult.release).toHaveBeenCalledTimes(1);
   });
 
+  it.each([
+    ["null", "null"],
+    ["array", "[]"],
+    ["non-string tag_name", JSON.stringify({ tag_name: 123, assets: [] })],
+    ["non-array assets", JSON.stringify({ tag_name: "v0.14.6", assets: {} })],
+  ])("returns an installer error for a valid JSON %s payload", async (_kind, body) => {
+    const fetchResult = okDownloadResponse(body, {
+      headers: { "content-type": "application/json" },
+    });
+    fetchWithSsrFGuardMock.mockResolvedValue(fetchResult);
+
+    const result = await installSignalCliFromRelease({ log: vi.fn() } as unknown as RuntimeEnv);
+
+    expect(result).toEqual({
+      ok: false,
+      error: "Failed to parse signal-cli release info.",
+    });
+    expect(fetchResult.release).toHaveBeenCalledTimes(1);
+  });
+
   it("bounds oversized GitHub release metadata and cancels the stream", async () => {
     const chunkSize = 1024 * 1024;
     const chunkCount = 20; // 20 MiB — over the 16 MiB cap
@@ -517,13 +537,16 @@ describe("installSignalCliFromRelease", () => {
     }
   });
 
-  it("removes the download temp dir when the download throws", async () => {
+  it("skips malformed asset rows while retaining a valid download", async () => {
     setProcessPlatform("linux", "x64");
     fetchWithSsrFGuardMock.mockResolvedValueOnce(
       okDownloadResponse(
         JSON.stringify({
           tag_name: "v0.0.0-download-failure-test",
           assets: [
+            null,
+            { name: 42, browser_download_url: "https://example.com/wrong-name.tar.gz" },
+            { name: "signal-cli-wrong-url.tar.gz", browser_download_url: false },
             {
               name: "signal-cli-0.0.0-Linux-native.tar.gz",
               browser_download_url: "https://example.com/linux-native.tar.gz",
@@ -539,6 +562,10 @@ describe("installSignalCliFromRelease", () => {
       installSignalCliFromRelease({ log: vi.fn() } as unknown as RuntimeEnv),
     ).rejects.toThrow("download failed");
 
+    expect(fetchWithSsrFGuardMock).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({ url: "https://example.com/linux-native.tar.gz" }),
+    );
     await expectTempDownloadDirMissing();
   });
 });
diff --git a/extensions/signal/src/install-signal-cli.ts b/extensions/signal/src/install-signal-cli.ts
@@ -5,12 +5,15 @@ import path from "node:path";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
-import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
+import { readProviderJsonObjectResponse } from "openclaw/plugin-sdk/provider-http";
 import { runPluginCommandWithTimeout } from "openclaw/plugin-sdk/run-command";
 import type { RuntimeEnv } from "openclaw/plugin-sdk/runtime-env";
 import { CONFIG_DIR, extractArchive, resolveBrewExecutable } from "openclaw/plugin-sdk/setup-tools";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
-import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
+import {
+  isRecord,
+  normalizeLowercaseStringOrEmpty,
+} from "openclaw/plugin-sdk/string-coerce-runtime";
 import { withTempDownloadPath } from "openclaw/plugin-sdk/temp-path";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 
@@ -325,7 +328,26 @@ export async function installSignalCliFromRelease(
       };
     }
     try {
-      payload = await readProviderJsonResponse<ReleaseResponse>(response, "signal.release-info");
+      const releaseInfo = await readProviderJsonObjectResponse(response, "signal.release-info");
+      const tagName = releaseInfo.tag_name;
+      if (tagName !== undefined && typeof tagName !== "string") {
+        throw new Error("Unexpected signal-cli release info");
+      }
+      const releaseAssets = releaseInfo.assets;
+      if (releaseAssets !== undefined && !Array.isArray(releaseAssets)) {
+        throw new Error("Unexpected signal-cli release info");
+      }
+      const assets = (releaseAssets ?? []).flatMap((asset): ReleaseAsset[] => {
+        if (
+          !isRecord(asset) ||
+          typeof asset.name !== "string" ||
+          typeof asset.browser_download_url !== "string"
+        ) {
+          return [];
+        }
+        return [{ name: asset.name, browser_download_url: asset.browser_download_url }];
+      });
+      payload = { tag_name: tagName, assets };
     } catch {
       return {
         ok: false,
