openclaw

furyhawk/openclaw

Fork 0

mirror of https://github.com/openclaw/openclaw.git synced 2026-07-21 02:06:43 +00:00

Files

T

History

3d03b60da9 fix(litellm): guard loopback hostname auto-allow with isIP to prevent DNS SSRF bypass (#110693 )

* fix(litellm): guard loopback hostname auto-allow with isIP to prevent DNS bypass

The isAutoAllowedLitellmHostname helper auto-enables private-network access
for loopback-style hosts. Before this fix, lowered.startsWith("127.")
matched DNS hostnames like 127.evil.com, letting remote endpoints bypass
the explicit allowPrivateNetwork opt-in — a SSRF risk.

Add isIP(host)===4 guard so only literal IPv4 loopback addresses qualify.
Same canonical pattern as extensions/slack/src/monitor/relay-source.ts:271
and the codex loopback fix.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(litellm): cover loopback endpoint policy

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>

2026-07-19 00:51:50 +01:00

api.ts

docs: document small extension sources

2026-06-04 21:02:07 -04:00

image-generation-provider.test.ts

fix(litellm): guard loopback hostname auto-allow with isIP to prevent DNS SSRF bypass (#110693 )

2026-07-19 00:51:50 +01:00

image-generation-provider.ts

fix(litellm): guard loopback hostname auto-allow with isIP to prevent DNS SSRF bypass (#110693 )

2026-07-19 00:51:50 +01:00

index.test.ts

fix(providers): preserve Claude output limits