fix(nextcloud-talk,discord): bound response body reads for webhook and error paths

lwy-2 · claude · lwy-2 · commit 60292e2e9e46 · 2026-06-30T16:44:24.000+08:00
Bound two unbounded response body reads to prevent potential OOM:
- extensions/nextcloud-talk/src/bot-preflight.ts: error-path
  response.text() for Nextcloud API error body was unbounded.
- extensions/discord/src/send.webhook.ts: happy-path response.json()
  for Discord webhook send result was unbounded (error path already
  used readResponseTextLimited).

These follow the same project-wide bound-response-read pattern.

Co-Authored-By: Claude &lt;noreply@anthropic.com&gt;
diff --git a/extensions/discord/src/send.webhook.ts b/extensions/discord/src/send.webhook.ts
@@ -1,7 +1,10 @@
 // Discord plugin module implements send.webhook behavior.
 import { recordChannelActivity } from "openclaw/plugin-sdk/channel-activity-runtime";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/config-contracts";
-import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
+import {
+  readProviderJsonResponse,
+  readResponseTextLimited,
+} from "openclaw/plugin-sdk/provider-http";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { resolveDiscordClientAccountContext } from "./client.js";
 import {
@@ -120,10 +123,10 @@ export async function sendWebhookMessageDiscord(
     await throwWebhookResponseError(response);
   }
 
-  const payload = (await response.json().catch(() => ({}))) as {
+  const payload = await readProviderJsonResponse<{
     id?: string;
     channel_id?: string;
-  };
+  }>(response, "Discord webhook send").catch(() => ({}) as { id?: string; channel_id?: string });
   try {
     recordChannelActivity({
       channel: "discord",
diff --git a/extensions/nextcloud-talk/src/bot-preflight.ts b/extensions/nextcloud-talk/src/bot-preflight.ts
@@ -1,7 +1,10 @@
 // Nextcloud Talk plugin module implements bot preflight behavior.
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
-import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
+import {
+  readProviderJsonResponse,
+  readResponseTextLimited,
+} from "openclaw/plugin-sdk/provider-http";
 import { fetchWithSsrFGuard } from "../runtime-api.js";
 import type { ResolvedNextcloudTalkAccount } from "./accounts.js";
 import { resolveNextcloudTalkApiCredentials } from "./api-credentials.js";
@@ -125,7 +128,7 @@ export async function probeNextcloudTalkBotResponseFeature(params: {
     });
     try {
       if (!response.ok) {
-        const body = await response.text().catch(() => "");
+        const body = await readResponseTextLimited(response, 4 * 1024).catch(() => "");
         return {
           ok: false,
           code: "api_error",
