← Back to PRs

#6854: fix(abort): add size limit to ABORT_MEMORY map to prevent memory leak

by hclsys open 2026-02-02 03:53 View on GitHub →
## Summary Fix [CWE-770](https://cwe.mitre.org/data/definitions/770.html) vulnerability in `src/auto-reply/reply/abort.ts`. **Problem**: `ABORT_MEMORY` Map has no cleanup mechanism — entries accumulate indefinitely causing memory leak. **Fix**: Add size limit (10k entries) + delete entry on `setAbortMemory(key, false)` instead of storing `false`. ## Risk Summary - **Severity**: Medium (CWE-770 — Allocation of Resources Without Limits) - **Regression risk**: None — adds eviction only when map exceeds 10k, existing behavior unchanged below limit - **Scope**: Single file, 1 function modified ## Changes - `src/auto-reply/reply/abort.ts`: Add `MAX_ABORT_ENTRIES` constant and modify `setAbortMemory()` to: - Delete entry when value is `false` (wires into existing cleanup path in `body.ts:40`) - Evict oldest entry (FIFO) when map reaches 10k entries ## Verification - [x] `pnpm build` passes - [x] `pnpm lint` passes (0 warnings, 0 errors) - [x] `pnpm test` passes (804 test files, 4969 tests) ## Sign-Off - Models used: Claude Opus 4.6 - Submitter effort: Traced ABORT_MEMORY lifecycle through abort.ts and body.ts, verified FIFO eviction uses Map iteration order (insertion order per spec), confirmed delete-on-false wires into existing cleanup - Agent notes: N/A lobster-biscuit

Most Similar PRs