fix(skills): add timeout to Google OAuth urlopen calls (#28275)#28591
Conversation
🚨 CRITICAL Supply Chain Risk DetectedThis PR contains a pattern that has been used in real supply chain attacks. A maintainer must review the flagged code carefully before merging. 🚨 CRITICAL: Install-hook file added or modifiedThese files can execute code during package installation or interpreter startup. Files: Scanner only fires on high-signal indicators: .pth files, base64+exec/eval combos, subprocess with encoded commands, or install-hook files. Low-signal warnings were removed intentionally — if you're seeing this comment, the finding is worth inspecting. |
🔎 Lint report:
|
Salvage of #28275 by @Zyrixtrex.
What: Three Google OAuth/token
urllib.request.urlopen()call sites had notimeout=argument, so a hung Google endpoint could block the agent turn indefinitely (Python falls back to the global socket timeout, which is unset by default).How: Pass
timeout=15to eachurlopencall across:plugins/platforms/google_chat/oauth.py(revoke)skills/productivity/google-workspace/scripts/gws_bridge.py(refresh_token)skills/productivity/google-workspace/scripts/setup.py(revoke)Plus add explicit
URLError/TimeoutErrorhandling on the refresh path so a network failure prints a clean error instead of an unhandled exception. Test verifiestimeout=is passed.Original PR: #28275