fix(matrix): guard JSON.parse against malformed homeserver response bodies

lsr911 · claude · lsr911 · commit eddba8cb976f · 2026-06-30T10:43:28.000+08:00
Wrap JSON.parse(text) in MatrixAuthedHttpClient.requestJson with try/catch to prevent a malformed Matrix homeserver response from throwing an unhandled SyntaxError.

On parse failure, throw an Error with statusCode attached (matching the buildHttpError convention) so callers can handle it like any other Matrix API error.

Co-Authored-By: Claude &lt;noreply@anthropic.com&gt;
Signed-off-by: lsr911 &lt;liao.shirong@xydigit.com&gt;
diff --git a/extensions/matrix/src/matrix/sdk/http-client.test.ts b/extensions/matrix/src/matrix/sdk/http-client.test.ts
@@ -140,4 +140,33 @@ describe("MatrixAuthedHttpClient", () => {
     expect(httpError.message).toBe("forbidden");
     expect(httpError.statusCode).toBe(403);
   });
+
+  it("throws descriptive error on malformed JSON success response", async () => {
+    performMatrixRequestMock.mockResolvedValue({
+      response: new Response("NOT JSON {{{", {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      }),
+      text: "NOT JSON {{{",
+      buffer: Buffer.from("NOT JSON {{{", "utf8"),
+    });
+
+    const client = new MatrixAuthedHttpClient({
+      homeserver: "https://matrix.example.org",
+      accessToken: "token",
+    });
+    let rejection: unknown;
+    try {
+      await client.requestJson({
+        method: "GET",
+        endpoint: "/_matrix/client/v3/sync",
+        timeoutMs: 5000,
+      });
+    } catch (error) {
+      rejection = error;
+    }
+
+    expect(rejection).toBeInstanceOf(Error);
+    expect((rejection as Error).message).toContain("malformed JSON");
+  });
 });
diff --git a/extensions/matrix/src/matrix/sdk/http-client.ts b/extensions/matrix/src/matrix/sdk/http-client.ts
@@ -52,7 +52,14 @@ export class MatrixAuthedHttpClient {
       if (!text.trim()) {
         return {};
       }
-      return JSON.parse(text);
+      try {
+        return JSON.parse(text);
+      } catch {
+        throw Object.assign(
+          new Error("Matrix homeserver returned malformed JSON"),
+          { statusCode: response.status },
+        );
+      }
     }
     return text;
   }

Original file line number	Diff line number	Diff line change
`@@ -52,7 +52,14 @@ export class MatrixAuthedHttpClient {`
`52`	`52`	`if (!text.trim()) {`
`53`	`53`	`return {};`
`54`	`54`	`}`
`55`		`- return JSON.parse(text);`
	`55`	`+ try {`
	`56`	`+ return JSON.parse(text);`
	`57`	`+ } catch {`
	`58`	`+ throw Object.assign(`
	`59`	`+ new Error("Matrix homeserver returned malformed JSON"),`
	`60`	`+ { statusCode: response.status },`
	`61`	`+ );`
	`62`	`+ }`
`56`	`63`	`}`
`57`	`64`	`return text;`
`58`	`65`	`}`