A stalled webhook error body bypasses the timeout and blocks exit processing

Locations

• validator-ejector/src/services/webhook-caller/service.ts:23-27
• validator-ejector/src/lib/request/middlewares.ts:113-117
• validator-ejector/src/lib/request/middlewares.ts:135-140

Summary

A webhook response can bypass WEBHOOK_ABORT_TIMEOUT_MS by sending non-success headers and leaving its body unfinished. The pending request blocks subsequent exits and polling cycles.

Root cause

The webhook places notOkError() outside abort(). Once node-fetch returns response headers, abort() clears its timer; notOkError() then awaits extractErrorBody() without a deadline.

• Retries require a rejection, which the pending body read never produces.
• The job runner retains its lock until the handler settles.

Impact

A malfunctioning webhook or proxy can turn one incomplete error response into a daemon-wide interruption of required validator exits, even if subsequent requests would succeed. Processing resumes only when the response finishes, the connection fails, or the operator restarts the daemon. This is a medium-severity temporary core delivery DoS.

Scenario

1. The daemon dispatches an approved exit to its configured webhook.
2. The endpoint promptly sends HTTP 500 headers and a partial JSON body, then leaves the connection open.
3. The abort timer is cleared before error-body parsing finishes.
4. The configured timeout expires without rejection, retry, or an exit-error metric update.
5. Later validators remain unprocessed, and subsequent polling callbacks skip the locked job.

Start with validator-ejector/src/services/webhook-caller/service.ts:23-27 and the abort and error-body paths in validator-ejector/src/lib/request/middlewares.ts:113-117 and 135-140. Trace how a non-success response with an unfinished body interacts with WEBHOOK_ABORT_TIMEOUT_MS, retries, metrics, and the job lock. Done means the stalled response cannot block later exits or polling cycles and timeout handling resumes as expected.