Target platform / 目标平台
Windows
Summary / 一句话概括
Bound the update-check response before JSON deserialization / 在 JSON 反序列化前限制更新检查响应大小。
Problem / use case / 要解决的问题或场景
windows/scripts/check-update.ps1 uses Invoke-RestMethod for the fixed GitHub
Releases endpoint. Its timeout bounds waiting time, but the cmdlet can buffer
and deserialize the whole response before the script can apply a byte limit.
The macOS updater already has a pre-parse 1 MiB boundary, so the platforms have
different availability defenses. This is defense in depth, not an RCE claim.
Proposed solution / 期望方案
Use a Windows PowerShell 5.1-compatible streamed HTTP read with a 1 MiB cap.
Reject oversized declared or streamed bodies, empty bodies, invalid UTF-8,
invalid JSON, and malformed tags before ConvertFrom-Json. Preserve the fixed
GitHub HTTPS origin, TLS 1.2 behavior, 12-second timeout, -Json, and
-Interactive output contracts. Add a test-only local response seam that does
not let production configuration alter the remote origin.
Alternatives considered / 考虑过的替代方案
Keeping Invoke-RestMethod is simpler but cannot enforce a body-size limit
before buffering. A production-configurable update URL would make tests easier
but would weaken the fixed-origin boundary.
Priority / 对你有多重要
Would use often / 会经常用
Scope check / 范围确认
Extra context / 补充
The current source was checked at main@611c101. The requested work is limited
to bounded parsing and regression coverage; it does not change release download
or installation behavior.
Target platform / 目标平台
Windows
Summary / 一句话概括
Bound the update-check response before JSON deserialization / 在 JSON 反序列化前限制更新检查响应大小。
Problem / use case / 要解决的问题或场景
windows/scripts/check-update.ps1usesInvoke-RestMethodfor the fixed GitHubReleases endpoint. Its timeout bounds waiting time, but the cmdlet can buffer
and deserialize the whole response before the script can apply a byte limit.
The macOS updater already has a pre-parse 1 MiB boundary, so the platforms have
different availability defenses. This is defense in depth, not an RCE claim.
Proposed solution / 期望方案
Use a Windows PowerShell 5.1-compatible streamed HTTP read with a 1 MiB cap.
Reject oversized declared or streamed bodies, empty bodies, invalid UTF-8,
invalid JSON, and malformed tags before
ConvertFrom-Json. Preserve the fixedGitHub HTTPS origin, TLS 1.2 behavior, 12-second timeout,
-Json, and-Interactiveoutput contracts. Add a test-only local response seam that doesnot let production configuration alter the remote origin.
Alternatives considered / 考虑过的替代方案
Keeping
Invoke-RestMethodis simpler but cannot enforce a body-size limitbefore buffering. A production-configurable update URL would make tests easier
but would weaken the fixed-origin boundary.
Priority / 对你有多重要
Would use often / 会经常用
Scope check / 范围确认
app.asar.Extra context / 补充
The current source was checked at
main@611c101. The requested work is limitedto bounded parsing and regression coverage; it does not change release download
or installation behavior.