#6923: fix(memory): add timeouts to Gemini batch API fetch calls (CWE-400)
Cluster:
Gemini API Enhancements
## Summary
Add `AbortSignal.timeout()` to all 4 fetch calls in `batch-gemini.ts` to prevent resource exhaustion (CWE-400) from slow/malicious Gemini API servers.
Fixes #6852
## Risk Summary
- **Severity**: Medium (CWE-400 — Uncontrolled Resource Consumption)
- **Regression risk**: Low — timeout values are generous (30-120s per stage)
- **Scope**: Single file, 4 fetch calls
## Changes
- Timeout values: 120s (upload), 30s (batch create), 30s (status poll), 60s (download)
- Each timeout error includes stage-specific message and preserves original error via `{ cause: err }`
- Body reading (`.json()`/`.text()`) is included in timeout scope
## Verification
- [x] `pnpm build` passes
- [x] `pnpm lint` passes
- [x] `pnpm test` passes
- [x] `pnpm vitest run src/memory` — 47 tests pass
## Sign-Off
- Models used: Claude Opus 4.6
- Submitter effort: Manually reviewed batch-gemini.ts lifecycle, verified timeout values match stage duration expectations, confirmed error wrapping preserves cause chain
- Agent notes: N/A
lobster-biscuit
Most Similar PRs
#21843: fix: add retry/backoff to Gemini embedding batch API calls
by slegarraga · 2026-02-20
70.4%
#23745: fix(resilience): add timeout to unguarded fetch calls in browser su...
by kevinWangSheng · 2026-02-22
69.7%
#15585: fix: add retry/backoff for Gemini embedding API calls
by WalterSumbon · 2026-02-13
69.7%
#6916: fix(slack): add timeout to file download to prevent DoS (CWE-400)
by hclsys · 2026-02-02
68.0%
#8675: fix: Gemini batch embeddings state path, enum values, and download URL
by seasalim · 2026-02-04
66.2%
#14314: fix(agent-runner): auto-recover from Gemini INVALID_ARGUMENT errors
by thebtf · 2026-02-11
64.0%
#6854: fix(abort): add size limit to ABORT_MEMORY map to prevent memory leak
by hclsys · 2026-02-02
63.8%
#10636: fix: setTimeout integer overflow causing server crash
by devmangel · 2026-02-06
63.6%
#20315: fix(memory): add gemini-embedding-001 to GEMINI_MAX_INPUT_TOKENS
by Clawborn · 2026-02-18
63.0%
#7810: fix: add fetch timeouts to prevent memory indexing hangs (#4370)
by Kaizen-79 · 2026-02-03
62.5%