mirror of
https://github.com/openclaw/openclaw.git
synced 2026-05-12 11:37:49 +00:00
08ae021d1f
* fix(qqbot): replace raw fetch in image-size probe with SSRF-guarded fetchRemoteMedia Replace the bare fetch() in getImageSizeFromUrl() with fetchRemoteMedia() from the plugin SDK, closing the blind SSRF via markdown image dimension probing (GHSA-2767-2q9v-9326). fetchRemoteMedia options: maxBytes 65536, maxRedirects 0, generic public-network-only SSRF policy (no hostname allowlist, blocks private/reserved/loopback/link-local/metadata IPs after DNS resolution). Also fixes the repo-root resolution in scripts/lib/ts-guard-utils.mjs which caused lint:tmp:no-raw-channel-fetch to miss extension files entirely. The guard now walks up to .git instead of hardcoding two parent traversals, and the allowlist is refreshed with all pre-existing raw fetch callsites that became visible. * fix(qqbot): guard image-size probe against SSRF (#63495) (thanks @dims) --------- Co-authored-by: sliverp <870080352@qq.com> |
||
|---|---|---|
| .. | ||
| ts-topology | ||
| arg-utils.mjs | ||
| bundled-extension-manifest.ts | ||
| bundled-plugin-build-entries.d.mts | ||
| bundled-plugin-build-entries.d.ts | ||
| bundled-plugin-build-entries.mjs | ||
| bundled-plugin-paths.mjs | ||
| bundled-plugin-root-runtime-mirrors.mjs | ||
| bundled-plugin-source-utils.mjs | ||
| bundled-runtime-sidecar-paths.json | ||
| callsite-guard.mjs | ||
| changed-extensions.mjs | ||
| copy-assets.ts | ||
| docker-e2e-logs.sh | ||
| error-format.mjs | ||
| extension-package-boundary.ts | ||
| extension-source-classifier.d.mts | ||
| extension-source-classifier.mjs | ||
| extension-test-plan.mjs | ||
| format-generated-module.mjs | ||
| generated-output-utils.mjs | ||
| guard-inventory-utils.mjs | ||
| ios-version.ts | ||
| live-docker-auth.sh | ||
| live-docker-stage.sh | ||
| local-heavy-check-runtime.mjs | ||
| npm-publish-plan.mjs | ||
| optional-bundled-clusters.d.mts | ||
| optional-bundled-clusters.d.ts | ||
| optional-bundled-clusters.mjs | ||
| pairing-guard-context.mjs | ||
| plugin-clawhub-release.ts | ||
| plugin-npm-release.ts | ||
| plugin-sdk-doc-metadata.ts | ||
| plugin-sdk-entries.d.mts | ||
| plugin-sdk-entries.mjs | ||
| plugin-sdk-entrypoints.json | ||
| record-shared.mjs | ||
| run-extension-oxlint.mjs | ||
| ts-guard-utils.mjs | ||
| vitest-batch-runner.mjs | ||
| vitest-report-cli-utils.mjs | ||