fix(discord): bound pluralkit error bodies

vincentkoc · vincentkoc · commit aea208f0ac51 · 2026-06-19T14:29:11.000+02:00
diff --git a/extensions/discord/src/pluralkit.test.ts b/extensions/discord/src/pluralkit.test.ts
@@ -20,6 +20,28 @@ const buildResponse = (params: { status: number; body?: unknown }): MockResponse
   };
 };
 
+function cancelTrackedResponse(
+  text: string,
+  init: ResponseInit,
+): {
+  response: Response;
+  wasCanceled: () => boolean;
+} {
+  let canceled = false;
+  const stream = new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(new TextEncoder().encode(text));
+    },
+    cancel() {
+      canceled = true;
+    },
+  });
+  return {
+    response: new Response(stream, init),
+    wasCanceled: () => canceled,
+  };
+}
+
 describe("fetchPluralKitMessageInfo", () => {
   it("returns null when disabled", async () => {
     const fetcher = vi.fn();
@@ -65,4 +87,30 @@ describe("fetchPluralKitMessageInfo", () => {
     expect(result?.member?.id).toBe("mem_1");
     expect(receivedHeaders?.Authorization).toBe("pk_test");
   });
+
+  it("bounds PluralKit API error bodies without using response.text()", async () => {
+    const tracked = cancelTrackedResponse(`${"plural failure ".repeat(1024)}tail`, {
+      status: 500,
+      headers: { "content-type": "text/plain" },
+    });
+    const textSpy = vi.spyOn(tracked.response, "text").mockRejectedValue(new Error("unbounded"));
+    const fetcher = vi.fn(async () => tracked.response);
+
+    let caught: Error | undefined;
+    try {
+      await fetchPluralKitMessageInfo({
+        messageId: "boom",
+        config: { enabled: true },
+        fetcher: fetcher as unknown as typeof fetch,
+      });
+    } catch (error) {
+      caught = error as Error;
+    }
+
+    expect(caught?.message).toContain("PluralKit API failed (500): plural failure");
+    expect(caught?.message).not.toContain("tail");
+    expect(caught?.message.length).toBeLessThan(8_400);
+    expect(tracked.wasCanceled()).toBe(true);
+    expect(textSpy).not.toHaveBeenCalled();
+  });
 });
diff --git a/extensions/discord/src/pluralkit.ts b/extensions/discord/src/pluralkit.ts
@@ -1,7 +1,9 @@
 // Discord plugin module implements pluralkit behavior.
 import { resolveFetch } from "openclaw/plugin-sdk/fetch-runtime";
+import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
 
 const PLURALKIT_API_BASE = "https://api.pluralkit.me/v2";
+const PLURALKIT_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
 
 export type DiscordPluralKitConfig = {
   enabled?: boolean;
@@ -51,7 +53,9 @@ export async function fetchPluralKitMessageInfo(params: {
     return null;
   }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
+    const text = await readResponseTextLimited(res, PLURALKIT_ERROR_BODY_LIMIT_BYTES).catch(
+      () => "",
+    );
     const detail = text.trim() ? `: ${text.trim()}` : "";
     throw new Error(`PluralKit API failed (${res.status})${detail}`);
   }
