fix: validate synology rate limits

steipete · steipete · commit 409356fc666e · 2026-05-28T15:57:51.000-04:00
diff --git a/extensions/synology-chat/src/accounts.ts b/extensions/synology-chat/src/accounts.ts
@@ -66,15 +66,23 @@ function parseAllowedUserIds(raw: string | string[] | undefined): string[] {
   return normalizeStringEntries(raw.split(","));
 }
 
-function parseRateLimitPerMinute(raw: string | undefined): number {
-  if (raw == null) {
-    return 30;
+function normalizeRateLimitPerMinuteValue(raw: unknown): number | undefined {
+  if (typeof raw === "number") {
+    return Number.isSafeInteger(raw) && raw >= 0 ? raw : undefined;
+  }
+  if (typeof raw !== "string") {
+    return undefined;
   }
   const trimmed = raw.trim();
-  if (!/^-?\d+$/.test(trimmed)) {
-    return 30;
+  if (!/^\d+$/.test(trimmed)) {
+    return undefined;
   }
-  return parseStrictInteger(trimmed) ?? 30;
+  const parsed = parseStrictInteger(trimmed);
+  return parsed != null && parsed >= 0 ? parsed : undefined;
+}
+
+function parseRateLimitPerMinute(raw: string | undefined): number {
+  return normalizeRateLimitPerMinuteValue(raw) ?? 30;
 }
 
 /**
@@ -143,7 +151,8 @@ export function resolveAccount(
     dangerouslyAllowInheritedWebhookPath,
     dmPolicy: merged.dmPolicy ?? "allowlist",
     allowedUserIds: parseAllowedUserIds(merged.allowedUserIds ?? envAllowedUserIds),
-    rateLimitPerMinute: merged.rateLimitPerMinute ?? envRateLimitValue,
+    rateLimitPerMinute:
+      normalizeRateLimitPerMinuteValue(merged.rateLimitPerMinute) ?? envRateLimitValue,
     botName: merged.botName ?? envBotName,
     allowInsecureSsl: merged.allowInsecureSsl ?? false,
   };
diff --git a/extensions/synology-chat/src/core.test.ts b/extensions/synology-chat/src/core.test.ts
@@ -324,6 +324,28 @@ describe("synology-chat account resolution", () => {
 
     process.env.SYNOLOGY_RATE_LIMIT = "0abc";
     expect(resolveAccount({ channels: { "synology-chat": {} } }).rateLimitPerMinute).toBe(30);
+
+    process.env.SYNOLOGY_RATE_LIMIT = "-1";
+    expect(resolveAccount({ channels: { "synology-chat": {} } }).rateLimitPerMinute).toBe(30);
+  });
+
+  it("ignores malformed configured rate limits", () => {
+    process.env.SYNOLOGY_RATE_LIMIT = "12";
+
+    expect(
+      resolveAccount({
+        channels: {
+          "synology-chat": { rateLimitPerMinute: -1 },
+        },
+      }).rateLimitPerMinute,
+    ).toBe(12);
+    expect(
+      resolveAccount({
+        channels: {
+          "synology-chat": { rateLimitPerMinute: 1.5 },
+        },
+      }).rateLimitPerMinute,
+    ).toBe(12);
   });
 });
 
