github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-09 22:04:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: allow RFC2544 benchmark range (198.18.0.0/15) through SSRF filter

Browse Source 
Telegram's API and file servers resolve to IPs in the 198.18.0.0/15
range (RFC 2544 benchmarking range). The SSRF filter was blocking these
addresses because ipaddr.js classifies them as 'reserved', and the
filter also had an explicit RFC2544_BENCHMARK_PREFIX check that blocked
them unconditionally.

Fix: exempt 198.18.0.0/15 from the 'reserved' range block in
isBlockedSpecialUseIpv4Address(). Other 'reserved' ranges (TEST-NET-2,
TEST-NET-3, documentation prefixes) remain blocked. The explicit
RFC2544_BENCHMARK_PREFIX check is repurposed as the exemption guard.

Closes #24973
This commit is contained in:
User
2026-02-24 10:47:11 +08:00
committed by Peter Steinberger
parent 237b9be937
commit 9df80b73e2
4 changed files with 48 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/infra/net/ssrf.pinning.test.ts
View File

@@ -51,12 +51,20 @@ describe("ssrf pinning", () => {
it.each([
{ name: "RFC1918 private address", address: "10.0.0.8" },
{ name: "RFC2544 benchmarking range", address: "198.18.0.1" },
{ name: "TEST-NET-2 reserved range", address: "198.51.100.1" },
])("rejects blocked DNS results: $name", async ({ address }) => {
const lookup = vi.fn(async () => [{ address, family: 4 }]) as unknown as LookupFn;
await expect(resolvePinnedHostname("example.com", lookup)).rejects.toThrow(/private|internal/i);
});
it("allows RFC2544 benchmark range addresses (used by Telegram)", async () => {
const lookup = vi.fn(async () => [
{ address: "198.18.0.153", family: 4 },
]) as unknown as LookupFn;
const pinned = await resolvePinnedHostname("api.telegram.org", lookup);
expect(pinned.addresses).toContain("198.18.0.153");
});
it("falls back for non-matching hostnames", async () => {
const fallback = vi.fn((host: string, options?: unknown, callback?: unknown) => {
const cb = typeof options === "function" ? options : (callback as () => void);