T09 · Insecure Skill Coding Practices
- Location
scripts/lib/infra/qveris-client.mjs:115- Finding
Unbounded Secondary Full-Content Response Can Exhaust Process Memory
- Content
View full analysis
Vulnerability Details
File Location:
scripts/lib/infra/qveris-client.mjs, lines 115-124
Vulnerability Type: Unbounded network response buffering
Risk Level: MediumVulnerable Code
js const res = await fetchImpl(checked.url, { signal }); if (!res.ok) { return { ...initial, meta: { ...initial.meta, fetchError: `full content fetch failed: ${res.status}`, }, }; } const fullContent = await res.json();Technical Analysis
The secondary
full_content_file_urlretrieval parses the complete HTTP response throughres.json()without enforcing a maximum body size. Although primary tool execution accepts amax_response_sizevalue, that limit does not apply to this secondary request.The request has a timeout and validates that the URL uses HTTPS and belongs to
qveris.aior an allowed subdomain. These controls reduce SSRF exposure but do not limit the number of bytes buffered and parsed before the response is accepted.A compromised, malicious, or malfunctioning allowed endpoint can therefore return an extremely large JSON document. Node.js may buffer the body and allocate additional memory while decoding and parsing it, resulting in excessive resource consumption or process termination.
Attack Path
- A QVeris tool response contains malformed or unusable
truncated_contentand supplies afull_content_file_url. - The radar execution path calls
resolveToolPayloadwithfetchFullContent: true. - URL validation accepts an HTTPS URL hosted on
qveris.aior an allowed subdomain. - The allowed endpoint returns a very large JSON response.
- The client invokes
res.json()and buffers/parses the response without a byte limit. - The Agent process experiences excessive memory consumption, event-loop disruption, or termination.
Exploitation requires control or compromise of an allowed QVeris endpoint, or an operational failure that causes it to return an unexpectedly large payload.
Impact
...[truncated 345 chars]
- A QVeris tool response contains malformed or unusable
- Remediation
View remediation
Remediation Suggestions
- Stream the response body and enforce a strict maximum byte count before JSON parsing.
- Reject responses whose valid
Content-Lengthheader exceeds the configured limit, while still enforcing the streaming limit because the header may be absent or false. - Abort the request immediately when the accumulated body exceeds the limit.
- Reuse or derive the limit from the existing
max_response_sizesetting and impose a conservative hard upper bound. - Validate the response
Content-Typebefore parsing and reject non-JSON content. - Catch body-size and JSON-parsing failures and return a bounded, redacted error.
- Add tests covering oversized chunked responses, misleading
Content-Lengthvalues, missing length headers, invalid JSON, and requests aborted after crossing the byte limit. - Consider disabling secondary full-content retrieval by default unless the larger payload is necessary for the requested operation.