fix(pdf): guard native provider requests by eleqtrizit · Pull Request #97872 · openclaw/openclaw

eleqtrizit · 2026-06-29T16:22:33Z

Summary

Route native Anthropic/Gemini PDF provider requests through OpenClaw's shared guarded provider HTTP path.

Changes

Use resolveProviderHttpRequestConfig and postJsonRequest for native PDF provider POSTs.
Thread resolved model headers and provider request transport metadata from the PDF tool into native PDF helpers.
Replace successful provider res.json() parsing with bounded readProviderJsonResponse parsing.
Add focused regressions for private-network blocking, explicit allowPrivateNetwork opt-in, and oversized successful JSON responses.

Validation

corepack pnpm install --frozen-lockfile
node scripts/run-vitest.mjs src/agents/tools/pdf-native-providers.test.ts src/agents/tools/pdf-tool.test.ts
corepack pnpm format:check -- src/agents/tools/pdf-native-providers.ts src/agents/tools/pdf-tool.ts src/agents/tools/pdf-native-providers.test.ts
corepack pnpm tsgo:core
.agents/skills/autoreview/scripts/autoreview --mode local --parallel-tests "node scripts/run-vitest.mjs src/agents/tools/pdf-native-providers.test.ts src/agents/tools/pdf-tool.test.ts" clean, no accepted/actionable findings

Notes

corepack pnpm check:changed -- src/agents/tools/pdf-native-providers.ts src/agents/tools/pdf-tool.ts src/agents/tools/pdf-native-providers.test.ts did not run checks because the delegated Blacksmith Testbox path failed at local crabbox binary sanity checks before executing the lane.

eleqtrizit · 2026-06-29T16:24:36Z

Behavioral and compatibility proof for ClawSweeper, updated for commit 6be4158786c0441521c95dd4f7fddaac638c020f.

What changed in the blocker fix:

resolveProviderHttpRequestConfig retains its original plugin-SDK TypeScript and runtime return shape.
Native Anthropic and Gemini PDF requests use the core-only resolveProviderHttpRequestConfigWithOriginTrust path.
Guarded dispatch, exact configured-origin trust, off-origin redirect blocking, explicit private-network opt-in, and bounded JSON parsing remain unchanged.

Fresh real endpoint proof at the pushed SHA:

Started two actual loopback HTTP servers and called the production anthropicAnalyzePdf helper.
Did not mock fetch and did not use external credentials.
Exercised exact-origin success, an off-origin private redirect without opt-in, and the same redirect with explicit opt-in.
Inspected the real resolver return objects to confirm the SDK result omits the internal trust field while the core-only result retains it.

{"sha":"6be4158786c0441521c95dd4f7fddaac638c020f","exactOrigin":"loopback-ok","offOriginWithoutOptIn":"blocked","offOriginWithOptIn":"loopback-ok","sdkReturnHasTrustField":false,"coreReturnTrustsConfiguredOrigin":true}

Guard diagnostic for the denied redirect:

[security] blocked URL fetch (url-fetch) targetOrigin=http://127.0.0.1:<port> reason=Blocked hostname or private/internal/special-use IP address

Fresh validation on the committed tree:

corepack pnpm check:test-types passed, including the previously failing Fal typed mock.
node scripts/run-vitest.mjs src/agents/tools/pdf-native-providers.test.ts src/agents/tools/pdf-tool.test.ts src/agents/provider-transport-fetch.test.ts src/media-understanding/shared.test.ts passed: 4 files, 166 tests.
corepack pnpm tsgo:core passed.
Targeted formatting and oxlint passed.
Source/extension, SDK-package/extension, and test-helper/extension boundary inventories returned no violations.
Autoreview completed cleanly with no accepted/actionable findings.
The GitHub Real behavior proof check passed at this SHA: https://github.com/openclaw/openclaw/actions/runs/28389339770/job/84112077202

Commit: eleqtrizit@6be4158

eleqtrizit · 2026-06-29T16:24:37Z

@clawsweeper re-review

clawsweeper · 2026-06-29T16:24:40Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

clawsweeper · 2026-06-29T16:27:43Z

Codex review: needs maintainer review before merge. Reviewed June 29, 2026, 6:50 PM ET / 22:50 UTC.

Summary
The PR routes Anthropic and Gemini native PDF provider POSTs through shared guarded provider HTTP helpers, threads model transport metadata, preserves resolver compatibility, and adds SSRF plus bounded JSON regressions.

PR surface: Source +113, Tests +109. Total +222 across 6 files.

Reproducibility: yes. for source-level review: current main still uses direct native PDF provider fetches with bare success JSON parsing and no model request transport metadata. The contributor also posted live loopback output proving the guarded after-fix behavior.

Review metrics: 1 noteworthy metric.

Native PDF Provider POST Paths: 2 changed. Both Anthropic and Gemini native PDF provider calls move onto guarded transport, which is the compatibility and security-boundary surface maintainers need to accept.

Stored data model
Persistent data-model change detected: serialized state: src/agents/tools/pdf-native-providers.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Risk before merge

[P1] Existing native PDF custom/local provider setups that relied on off-origin private redirects or unguarded private-network behavior will now fail closed unless maintainers accept that upgrade behavior.
[P1] Successful native PDF JSON responses now use the shared provider response cap, so unusually large legitimate provider outputs would fail instead of buffering unbounded data.

Maintainer options:

Accept The Guarded Native PDF Boundary (recommended)
Merge after maintainer review if stricter SSRF, redirect, and bounded-response behavior is intended for native Anthropic and Gemini PDF requests.
Require A Compatibility Path
If current custom or local native PDF setups must keep broader private-network or redirect behavior, require an explicit upgrade path or opt-in before merge.

Next step before merge

[P2] The PR has a protected maintainer label and the remaining decision is explicit acceptance of the stricter native PDF provider network boundary, not a narrow automated repair.

Security
Cleared: The diff narrows native PDF provider network behavior through existing guarded fetch helpers and adds no dependency, workflow, secret, or supply-chain surface.

Review details

Best possible solution:

Land the guarded native PDF transport after maintainers explicitly accept the stricter native provider network boundary and normal required checks are green.

Do we have a high-confidence way to reproduce the issue?

Yes, for source-level review: current main still uses direct native PDF provider fetches with bare success JSON parsing and no model request transport metadata. The contributor also posted live loopback output proving the guarded after-fix behavior.

Is this the best way to solve the issue?

Yes, with maintainer acceptance of the boundary change: reusing the shared guarded provider HTTP path is the narrow owner-boundary fix, and the latest head preserves the SDK-facing resolver shape.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against cbdbb22c603e.

Label changes

Label justifications:

P2: This is a focused native PDF provider hardening fix with limited blast radius but non-trivial compatibility and security-boundary behavior.
merge-risk: 🚨 compatibility: The PR changes existing native PDF network and success-response behavior for custom/local endpoints, redirects, and large JSON responses.
merge-risk: 🚨 security-boundary: The PR intentionally moves native PDF provider POSTs onto SSRF-guarded transport and changes private-network enforcement.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): Sufficient live-output proof is present: the contributor posted real loopback-server results for success, blocked redirect, explicit opt-in, and resolver compatibility, and the Real behavior proof check passed at head.
proof: sufficient: Contributor real behavior proof is sufficient. Sufficient live-output proof is present: the contributor posted real loopback-server results for success, blocked redirect, explicit opt-in, and resolver compatibility, and the Real behavior proof check passed at head.

Evidence reviewed

PR surface:

Source +113, Tests +109. Total +222 across 6 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	4	177	64	+113
Tests	2	162	53	+109
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	6	339	117	+222

What I checked:

repository_policy_read: Root AGENTS.md was read fully; it treats provider routing, fallback, fail-closed behavior, and security-boundary changes as compatibility-sensitive review surfaces requiring whole-surface review. (AGENTS.md:29, cbdbb22c603e)
scoped_policy_read: Scoped agent-tool guidance was read; it emphasizes keeping tool tests lightweight and preserving exact production composition in named helpers when behavior proof moves. (src/agents/tools/AGENTS.md:1, cbdbb22c603e)
current_main_direct_fetch: Current main still sends Anthropic native PDF requests with direct fetch and parses successful responses via bare res.json, so the central hardening target remains present. (src/agents/tools/pdf-native-providers.ts:69, cbdbb22c603e)
current_main_missing_transport_metadata: Current main passes only baseUrl from the PDF tool into native provider helpers, so model headers and request transport policy are absent from that path. (src/agents/tools/pdf-tool.ts:203, cbdbb22c603e)
pr_head_guarded_post: At PR head, native PDF JSON POSTs go through postJsonRequest, release the guarded response, and parse success bodies with readProviderJsonResponse. (src/agents/tools/pdf-native-providers.ts:45, 6be4158786c0)
pr_head_resolver_compatibility: The public resolveProviderHttpRequestConfig return shape is preserved while the new origin-trust field is exposed only through a core-only helper. (src/media-understanding/shared.ts:384, 6be4158786c0)

Likely related people:

tyler6204: Merged the PDF analysis tool work that introduced the native Anthropic/Gemini PDF provider helpers now being hardened. (role: feature introducer; confidence: high; commits: d0ac1b019517, 2c257cf97d13, 0b57ca3b5ce3; files: src/agents/tools/pdf-native-providers.ts, src/agents/tools/pdf-tool.ts)
vincentkoc: Introduced the shared media/provider request shaping helper that this PR reuses and keeps SDK-compatible. (role: shared provider HTTP contributor; confidence: high; commits: f28f0f29ba90, d51185076b7a; files: src/media-understanding/shared.ts, src/plugin-sdk/provider-http.ts)
steipete: Recent history includes PDF model-path and shared helper cleanup adjacent to the touched PDF/provider path. (role: recent adjacent contributor; confidence: medium; commits: 998cc02af40c; files: src/agents/tools/pdf-tool.ts, src/media-understanding/shared.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

eleqtrizit · 2026-06-29T16:46:33Z

@clawsweeper re-review

clawsweeper · 2026-06-29T16:46:36Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

* fix(pdf): guard native provider requests * fix(pdf): preserve configured origin trust * fix(pdf): preserve resolver compatibility

fix(pdf): guard native provider requests

3d639eb

openclaw-barnacle Bot added agents Agent runtime and tooling size: M maintainer Maintainer-authored PR labels Jun 29, 2026

fix(pdf): preserve configured origin trust

289c193

eleqtrizit self-assigned this Jun 29, 2026

fix(pdf): preserve resolver compatibility

6be4158

eleqtrizit merged commit b7b2e1f into openclaw:main Jun 29, 2026
170 of 177 checks passed

clawsweeper Bot mentioned this pull request Jun 30, 2026

fix(pdf): bound AI provider response reads in PDF text extraction #97696

Closed

github-actions Bot mentioned this pull request Jun 30, 2026

📡 Upstream Digest — 2026-06-30 02:37 UTC curtismercier/openclaw-mods#1176

Open

cxbAsDev mentioned this pull request Jun 30, 2026

fix(agents): bound MiniMax VLM JSON response reads, fix test mocks and lint #98213

Closed

eleqtrizit deleted the 786 branch June 30, 2026 19:27

QiuYuang pushed a commit to QiuYuang/openclaw that referenced this pull request Jul 1, 2026

fix(pdf): guard native provider requests (openclaw#97872)

48c3546

* fix(pdf): guard native provider requests * fix(pdf): preserve configured origin trust * fix(pdf): preserve resolver compatibility

clawsweeper Bot mentioned this pull request Jul 3, 2026

fix(infra): enforce maxBytes in body-less HTTP error snippet path #99340

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(pdf): guard native provider requests#97872

fix(pdf): guard native provider requests#97872
eleqtrizit merged 3 commits into
openclaw:mainfrom
eleqtrizit:786

eleqtrizit commented Jun 29, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 29, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 29, 2026

Uh oh!

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 29, 2026

Uh oh!

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

eleqtrizit commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Validation

Notes

Uh oh!

eleqtrizit commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 29, 2026

Uh oh!

clawsweeper Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 29, 2026

Uh oh!

clawsweeper Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

eleqtrizit commented Jun 29, 2026 •

edited

Loading

eleqtrizit commented Jun 29, 2026 •

edited

Loading

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading