Skip to content

fix: prevent fetch response body leak in doctor command #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kwakayama merged 5 commits into from
Dec 9, 2025
Merged

fix: prevent fetch response body leak in doctor command #10

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8b60261
chore: fix types
kwakayama Dec 8, 2025
78a5d57
fix: prevent fetch response body leak in doctor command
kwakayama Dec 9, 2025
50b66a7
fix: all integration tests passing
kwakayama Dec 9, 2025
aa6b3ce
fix: update test assertions for React SSR comment markers
kwakayama Dec 9, 2025
55c908e
fix: simplify Promise delay pattern in test helper
kwakayama Dec 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/ai/workflow/blob/gcs-storage.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,7 +161,7 @@ export class GCSBlobStorage implements BlobStorage {
const response = await fetch(uploadUrl, {
method: "POST",
headers,
body: body,
body: body as BodyInit,
});

if (!response.ok) {
Expand Down
5 changes: 4 additions & 1 deletion src/cli/commands/doctor/server-checks.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,9 +109,10 @@ export async function checkRSCEndpoints(): Promise<DiagnosticResult[]> {
* Check RSC counters snapshot (metrics endpoint)
*/
export async function checkRSCCounters(): Promise<DiagnosticResult> {
let met: Response | null = null;
try {
const base = new URL("http://127.0.0.1:3000/");
const met = await fetch(new URL("/_metrics", base)).catch(() => null);
met = await fetch(new URL("/_metrics", base)).catch(() => null);
if (met?.ok) {
const j = (await met.json().catch(() => null)) as any;
const c = j && (j as any).counters ? (j as any).counters : {};
Expand All @@ -120,6 +121,7 @@ export async function checkRSCCounters(): Promise<DiagnosticResult> {
} action:${c.rscAction ?? 0} errors:${c.rscErrors ?? 0}`;

Copilot AI Dec 9, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing safeCancelBody(met) call in the success path. The response body should be cancelled after consuming it with met.json() to prevent resource leaks, similar to how it's done in checkRSCEndpoints() for the manifest and stream responses (lines 71, 89). Add await safeCancelBody(met); before the return statement on line 122.

Suggested change
} action:${c.rscAction ?? 0} errors:${c.rscErrors ?? 0}`;
} action:${c.rscAction ?? 0} errors:${c.rscErrors ?? 0}`;
await safeCancelBody(met);

Copilot uses AI. Check for mistakes.
return { name: "RSC Counters", status: "pass", message: msg };
} else {
await safeCancelBody(met);
return {
name: "RSC Counters",
status: "warn",
Expand All @@ -128,6 +130,7 @@ export async function checkRSCCounters(): Promise<DiagnosticResult> {
}
} catch (error) {
cliLogger.debug("Failed to check RSC counters:", error);
await safeCancelBody(met);
return {
name: "RSC Counters",
status: "warn",
Expand Down
4 changes: 2 additions & 2 deletions src/server/handlers/request/static.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,8 +155,8 @@ export class StaticHandler extends BaseHandler {
const builder = this.createResponseBuilder(ctx);

// For HEAD requests, don't include body
// Cast to Uint8Array to satisfy BodyInit type in newer TypeScript
const body = req.method.toUpperCase() === "HEAD" ? null : fileData as Uint8Array;
// Cast to BodyInit to satisfy type in newer TypeScript/Deno versions
const body = req.method.toUpperCase() === "HEAD" ? null : fileData as BodyInit;

const response = builder
.withCORS(req, ctx.securityConfig?.cors)
Expand Down
Loading