mirror of
https://github.com/openclaw/openclaw.git
synced 2026-05-13 04:48:15 +00:00
08ae021d1f
* fix(qqbot): replace raw fetch in image-size probe with SSRF-guarded fetchRemoteMedia Replace the bare fetch() in getImageSizeFromUrl() with fetchRemoteMedia() from the plugin SDK, closing the blind SSRF via markdown image dimension probing (GHSA-2767-2q9v-9326). fetchRemoteMedia options: maxBytes 65536, maxRedirects 0, generic public-network-only SSRF policy (no hostname allowlist, blocks private/reserved/loopback/link-local/metadata IPs after DNS resolution). Also fixes the repo-root resolution in scripts/lib/ts-guard-utils.mjs which caused lint:tmp:no-raw-channel-fetch to miss extension files entirely. The guard now walks up to .git instead of hardcoding two parent traversals, and the allowlist is refreshed with all pre-existing raw fetch callsites that became visible. * fix(qqbot): guard image-size probe against SSRF (#63495) (thanks @dims) --------- Co-authored-by: sliverp <870080352@qq.com> |
||
|---|---|---|
| .. | ||
| audit-seams.test.ts | ||
| build-all.test.ts | ||
| bundled-plugin-build-entries.test.ts | ||
| check-channel-agnostic-boundaries.test.ts | ||
| check-extension-package-tsc-boundary.test.ts | ||
| check-file-utils.test.ts | ||
| check-no-conflict-markers.test.ts | ||
| check-no-random-messaging-tmp.test.ts | ||
| check-no-raw-window-open.test.ts | ||
| committer.test.ts | ||
| extension-source-classifier.test.ts | ||
| gh-read.test.ts | ||
| ios-pin-version.test.ts | ||
| ios-team-id.test.ts | ||
| ios-version.test.ts | ||
| lint-suppressions.test.ts | ||
| local-heavy-check-runtime.test.ts | ||
| npm-runner.test.ts | ||
| oxlint-config.test.ts | ||
| pnpm-runner.test.ts | ||
| postinstall-bundled-plugins.test.ts | ||
| prepare-extension-package-boundary-artifacts.test.ts | ||
| run-vitest-profile.test.ts | ||
| run-vitest.test.ts | ||
| runtime-postbuild.test.ts | ||
| stage-bundled-plugin-runtime-deps.test.ts | ||
| stage-bundled-plugin-runtime.test.ts | ||
| test-extension.test.ts | ||
| test-helpers.ts | ||
| test-projects.test.ts | ||
| test-report-utils.test.ts | ||
| ts-guard-utils.test.ts | ||
| ts-topology.test.ts | ||
| tsdown-build.test.ts | ||
| ui.test.ts | ||
| vitest-process-group.test.ts | ||
| write-cli-startup-metadata.test.ts | ||