mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-10 13:31:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Enforce Feishu webhook body limit while reading

Browse source
This commit is contained in:
luyifan 2026-06-29 22:30:35 +08:00 • committed by Teknium
parent e82d71db40
commit a26680eb2d
2 changed files with 62 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

27
plugins/platforms/feishu/adapter.py
View file

@ -228,6 +228,19 @@ _APPROVAL_LABEL_MAP: Dict[str, str] = {
"always": "Approved permanently",
"deny": "Denied",
}
async def _read_limited_feishu_webhook_body(request: Any, max_bytes: int) -> bytes:
"""Read at most ``max_bytes`` from an aiohttp request body."""
try:
body = await request.content.readexactly(max_bytes + 1)
except asyncio.IncompleteReadError as exc:
body = exc.partial
if len(body) > max_bytes:
raise ValueError("payload too large")
return body
_FEISHU_BOT_MSG_TRACK_SIZE = 512 # LRU size for tracking sent message IDs
_FEISHU_REPLY_FALLBACK_CODES = frozenset({230011, 231003}) # reply target withdrawn/missing → create fallback
@ -3467,9 +3480,16 @@ class FeishuAdapter(BasePlatformAdapter):
try:
body_bytes: bytes = await asyncio.wait_for(
request.read(),
_read_limited_feishu_webhook_body(
request,
_FEISHU_WEBHOOK_MAX_BODY_BYTES,
),
timeout=_FEISHU_WEBHOOK_BODY_TIMEOUT_SECONDS,
)
except ValueError:
logger.warning("[Feishu] Webhook body exceeds limit from %s", remote_ip)
self._record_webhook_anomaly(remote_ip, "413")
return web.Response(status=413, text="Request body too large")
except asyncio.TimeoutError:
logger.warning("[Feishu] Webhook body read timed out after %ds from %s", _FEISHU_WEBHOOK_BODY_TIMEOUT_SECONDS, remote_ip)
self._record_webhook_anomaly(remote_ip, "408")
@ -3478,11 +3498,6 @@ class FeishuAdapter(BasePlatformAdapter):
self._record_webhook_anomaly(remote_ip, "400")
return web.json_response({"code": 400, "msg": "failed to read body"}, status=400)
if len(body_bytes) > _FEISHU_WEBHOOK_MAX_BODY_BYTES:
logger.warning("[Feishu] Webhook body exceeds limit (%d bytes) from %s", len(body_bytes), remote_ip)
self._record_webhook_anomaly(remote_ip, "413")
return web.Response(status=413, text="Request body too large")
try:
payload = json.loads(body_bytes.decode("utf-8"))
except (json.JSONDecodeError, UnicodeDecodeError):