fix(qqbot): allow RFC2544 benchmark range for token fetch (#88984)#89015
Merged
Conversation
Contributor
|
Codex review: needs maintainer review before merge. Reviewed June 1, 2026, 10:58 PM ET / 02:58 UTC. Summary PR surface: Source +19, Tests +23. Total +42 across 2 files. Reproducibility: yes. from source, not from a live QQ credential run: current main calls fetchWithSsrFGuard for the hard-coded token URL without a policy, and the SSRF contract blocks 198.18.0.0/15 unless allowRfc2544BenchmarkRange is true. The linked issue supplies the observed 198.18.0.70 DNS/error log. Review metrics: 1 noteworthy metric.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Risk before merge
Maintainer options:
Next step before merge
Security Review detailsBest possible solution: Land the narrow host-scoped exception only after a maintainer/security owner accepts the SSRF tradeoff; otherwise keep the default strict token-fetch policy. Do we have a high-confidence way to reproduce the issue? Yes from source, not from a live QQ credential run: current main calls fetchWithSsrFGuard for the hard-coded token URL without a policy, and the SSRF contract blocks 198.18.0.0/15 unless allowRfc2544BenchmarkRange is true. The linked issue supplies the observed 198.18.0.70 DNS/error log. Is this the best way to solve the issue? Yes, if maintainers accept the security tradeoff: adding a hostnameAllowlist-limited policy at the hard-coded token fetch is narrower than a global default or config change and mirrors the existing QQ Bot media fake-IP pattern. AGENTS.md: found and applied where relevant. Codex review notes: model gpt-5.5, reasoning high; reviewed against 9d9a6140a3e4. Label changesLabel changes:
Label justifications:
Evidence reviewedPR surface: Source +19, Tests +23. Total +42 across 2 files. View PR surface stats
Security concerns:
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
QQ Bot `bots.qq.com` token-fetch path was failing for users whose DNS resolver maps the hostname into the RFC 2544 benchmark range `198.18.0.0/15` (commonly seen with fake-IP proxy stacks: sing-box, Clash, Surge, WSL2 DNS). The default SSRF guard treats that range as private and blocks the request, surfacing as "Network error getting access_token: Blocked: resolves to private/internal/special-use IP address".
Pass a host-scoped `SsrFPolicy` (`allowRfc2544BenchmarkRange: true`) to the single hard-coded `TOKEN_URL` request, mirroring the existing `QQBOT_MEDIA_SSRF_POLICY` pattern used by the media path. Because `TOKEN_URL` is a const and not user-controlled, the relaxation cannot widen attack surface to other hosts.
Adds a regression test asserting `policy: { allowRfc2544BenchmarkRange: true }` is forwarded into `fetchWithSsrFGuard`, and updates the existing equality assertion accordingly.
Fixes #88984
f337c29 to
8c5c3e3
Compare
Member
Author
github-actions Bot
pushed a commit
to Desicool/openclaw
that referenced
this pull request
Jun 3, 2026
…8984) (openclaw#89015) * fix(qqbot): allow RFC2544 benchmark range for token fetch (openclaw#88984) QQ Bot `bots.qq.com` token-fetch path was failing for users whose DNS resolver maps the hostname into the RFC 2544 benchmark range `198.18.0.0/15` (commonly seen with fake-IP proxy stacks: sing-box, Clash, Surge, WSL2 DNS). The default SSRF guard treats that range as private and blocks the request, surfacing as "Network error getting access_token: Blocked: resolves to private/internal/special-use IP address". Pass a host-scoped `SsrFPolicy` (`allowRfc2544BenchmarkRange: true`) to the single hard-coded `TOKEN_URL` request, mirroring the existing `QQBOT_MEDIA_SSRF_POLICY` pattern used by the media path. Because `TOKEN_URL` is a const and not user-controlled, the relaxation cannot widen attack surface to other hosts. Adds a regression test asserting `policy: { allowRfc2544BenchmarkRange: true }` is forwarded into `fetchWithSsrFGuard`, and updates the existing equality assertion accordingly. Fixes openclaw#88984 * fix(qqbot): scope token ssrf policy
SYU8384
pushed a commit
to SYU8384/openclaw
that referenced
this pull request
Jun 3, 2026
…8984) (openclaw#89015) * fix(qqbot): allow RFC2544 benchmark range for token fetch (openclaw#88984) QQ Bot `bots.qq.com` token-fetch path was failing for users whose DNS resolver maps the hostname into the RFC 2544 benchmark range `198.18.0.0/15` (commonly seen with fake-IP proxy stacks: sing-box, Clash, Surge, WSL2 DNS). The default SSRF guard treats that range as private and blocks the request, surfacing as "Network error getting access_token: Blocked: resolves to private/internal/special-use IP address". Pass a host-scoped `SsrFPolicy` (`allowRfc2544BenchmarkRange: true`) to the single hard-coded `TOKEN_URL` request, mirroring the existing `QQBOT_MEDIA_SSRF_POLICY` pattern used by the media path. Because `TOKEN_URL` is a const and not user-controlled, the relaxation cannot widen attack surface to other hosts. Adds a regression test asserting `policy: { allowRfc2544BenchmarkRange: true }` is forwarded into `fetchWithSsrFGuard`, and updates the existing equality assertion accordingly. Fixes openclaw#88984 * fix(qqbot): scope token ssrf policy
sablehead
pushed a commit
to sablehead/openclaw
that referenced
this pull request
Jun 10, 2026
…8984) (openclaw#89015) * fix(qqbot): allow RFC2544 benchmark range for token fetch (openclaw#88984) QQ Bot `bots.qq.com` token-fetch path was failing for users whose DNS resolver maps the hostname into the RFC 2544 benchmark range `198.18.0.0/15` (commonly seen with fake-IP proxy stacks: sing-box, Clash, Surge, WSL2 DNS). The default SSRF guard treats that range as private and blocks the request, surfacing as "Network error getting access_token: Blocked: resolves to private/internal/special-use IP address". Pass a host-scoped `SsrFPolicy` (`allowRfc2544BenchmarkRange: true`) to the single hard-coded `TOKEN_URL` request, mirroring the existing `QQBOT_MEDIA_SSRF_POLICY` pattern used by the media path. Because `TOKEN_URL` is a const and not user-controlled, the relaxation cannot widen attack surface to other hosts. Adds a regression test asserting `policy: { allowRfc2544BenchmarkRange: true }` is forwarded into `fetchWithSsrFGuard`, and updates the existing equality assertion accordingly. Fixes openclaw#88984 * fix(qqbot): scope token ssrf policy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
QQ Bot
bots.qq.comtoken-fetch path was failing for users whose DNS resolver maps the hostname into the RFC 2544 benchmark range198.18.0.0/15. This is the default behavior of fake-IP proxy stacks (sing-box, Clash, Surge) and some WSL2 DNS configurations. The default SSRF guard treats198.18.0.0/15as private/special-use and blocks the request, surfacing as:The QQ Bot channel cannot come up at all in such environments.
Fix
Pass a host-scoped
SsrFPolicy(allowRfc2544BenchmarkRange: true) to the single hard-codedTOKEN_URLrequest inTokenManager.doFetchToken(). BecauseTOKEN_URLis aconst(https://bots.qq.com/app/getAppAccessToken) and not user-controlled, the relaxation cannot widen the attack surface to any other host.This mirrors the existing
QQBOT_MEDIA_SSRF_POLICYpattern used byextensions/qqbot/src/engine/utils/file-utils.ts, which already addresses the same fake-IP scenario for the media-download path. The change is intentionally narrow / host-scoped — the global SSRF default stays strict.Test plan
pnpm exec vitest run extensions/qqbot/src/engine/api/token.test.ts— 5 / 5 passedpnpm check— typecheck + oxlint (core/extensions/scripts) + policy guards all cleanUpdated the existing equality assertion in
token.test.tsto include the newpolicyfield, and added a dedicated regression test that assertspolicy: { allowRfc2544BenchmarkRange: true }is forwarded intofetchWithSsrFGuard.Risk / rollback
Fixes #88984