mirror of
https://github.com/openclaw/openclaw.git
synced 2026-05-12 20:09:47 +00:00
08ae021d1f
* fix(qqbot): replace raw fetch in image-size probe with SSRF-guarded fetchRemoteMedia Replace the bare fetch() in getImageSizeFromUrl() with fetchRemoteMedia() from the plugin SDK, closing the blind SSRF via markdown image dimension probing (GHSA-2767-2q9v-9326). fetchRemoteMedia options: maxBytes 65536, maxRedirects 0, generic public-network-only SSRF policy (no hostname allowlist, blocks private/reserved/loopback/link-local/metadata IPs after DNS resolution). Also fixes the repo-root resolution in scripts/lib/ts-guard-utils.mjs which caused lint:tmp:no-raw-channel-fetch to miss extension files entirely. The guard now walks up to .git instead of hardcoding two parent traversals, and the allowlist is refreshed with all pre-existing raw fetch callsites that became visible. * fix(qqbot): guard image-size probe against SSRF (#63495) (thanks @dims) --------- Co-authored-by: sliverp <870080352@qq.com> |
||
|---|---|---|
| .. | ||
| fixtures | ||
| helpers | ||
| mocks | ||
| scripts | ||
| appcast.test.ts | ||
| architecture-smells.test.ts | ||
| cli-json-stdout.e2e.test.ts | ||
| extension-package-tsc-boundary.test.ts | ||
| extension-plugin-sdk-boundary.test.ts | ||
| extension-test-boundary.test.ts | ||
| gateway.multi.e2e.test.ts | ||
| git-hooks-pre-commit.test.ts | ||
| global-setup.ts | ||
| non-isolated-runner.ts | ||
| npm-publish-plan.test.ts | ||
| official-channel-catalog.test.ts | ||
| openclaw-launcher.e2e.test.ts | ||
| openclaw-npm-postpublish-verify.test.ts | ||
| openclaw-npm-release-check.test.ts | ||
| openclaw-prepack.test.ts | ||
| plugin-clawhub-release.test.ts | ||
| plugin-extension-import-boundary.test.ts | ||
| plugin-npm-release.test.ts | ||
| release-check.test.ts | ||
| sdk-package-extension-import-boundary.test.ts | ||
| setup-home-isolation.test.ts | ||
| setup-openclaw-runtime.ts | ||
| setup.extensions.ts | ||
| setup.shared.ts | ||
| setup.ts | ||
| src-extension-import-boundary.test.ts | ||
| test-env.test.ts | ||
| test-env.ts | ||
| ui.presenter-next-run.test.ts | ||
| vitest-boundary-config.test.ts | ||
| vitest-extensions-config.test.ts | ||
| vitest-light-paths.test.ts | ||
| vitest-performance-config.test.ts | ||
| vitest-projects-config.test.ts | ||
| vitest-scoped-config.test.ts | ||
| vitest-ui-package-config.test.ts | ||
| vitest-unit-config.test.ts | ||
| vitest-unit-fast-config.test.ts | ||
| vitest-unit-paths.test.ts | ||
| web-fetch-provider-boundary.test.ts | ||
| web-search-provider-boundary.test.ts | ||