diff --git a/scripts/lib/bounded-response.mjs b/scripts/lib/bounded-response.mjs index adafe8f88ab2..29600386ffd2 100644 --- a/scripts/lib/bounded-response.mjs +++ b/scripts/lib/bounded-response.mjs @@ -19,7 +19,7 @@ function parseContentLengthHeader(headers) { return undefined; } const parsed = Number(raw); - return Number.isSafeInteger(parsed) ? parsed : undefined; + return Number.isSafeInteger(parsed) ? parsed : Number.POSITIVE_INFINITY; } async function readResponseChunk(reader, label, signal, markCanceled) { diff --git a/scripts/lib/bounded-response.ts b/scripts/lib/bounded-response.ts index d50a9f8a5771..6d3d3d66553f 100644 --- a/scripts/lib/bounded-response.ts +++ b/scripts/lib/bounded-response.ts @@ -23,7 +23,7 @@ function parseContentLengthHeader(headers: Headers): number | undefined { return undefined; } const parsed = Number(raw); - return Number.isSafeInteger(parsed) ? parsed : undefined; + return Number.isSafeInteger(parsed) ? parsed : Number.POSITIVE_INFINITY; } async function readResponseChunk( diff --git a/test/scripts/bounded-response.test.ts b/test/scripts/bounded-response.test.ts index 29687949d9c2..bd5c92cbc504 100644 --- a/test/scripts/bounded-response.test.ts +++ b/test/scripts/bounded-response.test.ts @@ -98,4 +98,39 @@ describe("scripts bounded response reader", () => { expect(canceled).toBe(true); }, ); + + it.each(helpers)( + "rejects unsafe decimal %s content-length values before reading", + async (_name, read) => { + let readStarted = false; + let canceled = false; + const response = { + headers: new Headers({ "content-length": "9007199254740993" }), + body: { + async cancel() { + canceled = true; + }, + getReader() { + return { + async read() { + readStarted = true; + return new Promise>(() => {}); + }, + async cancel() { + canceled = true; + }, + releaseLock() {}, + }; + }, + }, + } as unknown as Response; + + await expect(read(response, "probe", 16)).rejects.toThrow( + "probe response body exceeded 16 bytes", + ); + + expect(readStarted).toBe(false); + expect(canceled).toBe(true); + }, + ); });