github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-25 17:33:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(mattermost): add SSRF policy for media downloads

Browse Source 
Allow fetching attachments from the Mattermost server host, which may
be localhost or a private IP. Without this, SSRF guards block inbound
media downloads silently.

Credit: @webclerk (#22594) for identifying this gap.
This commit is contained in:
Tony Dehnke
2026-02-24 04:10:26 +00:00
committed by Muhammed Mukhthar CM
parent 2e8c7ddf57
commit e1691fdfe6
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
extensions/mattermost/src/mattermost/monitor.ts
View File

@@ -674,6 +674,10 @@ export async function monitorMattermostProvider(opts: MonitorMattermostOpts = {}
},
filePathHint: fileId,
maxBytes: mediaMaxBytes,
// Allow fetching from the Mattermost server host (may be localhost or
// a private IP). Without this, SSRF guards block media downloads.
// Credit: #22594 (@webclerk)
ssrfPolicy: { allowedHostnames: [new URL(client.baseUrl).hostname] },
});
const saved = await core.channel.media.saveMediaBuffer(
fetched.buffer,