Davanum Srinivas 08ae021d1f
fix(qqbot): guard image-size probe against SSRF ( #63495 ) ...
* fix(qqbot): replace raw fetch in image-size probe with SSRF-guarded fetchRemoteMedia
Replace the bare fetch() in getImageSizeFromUrl() with fetchRemoteMedia()
from the plugin SDK, closing the blind SSRF via markdown image dimension
probing (GHSA-2767-2q9v-9326).
fetchRemoteMedia options: maxBytes 65536, maxRedirects 0, generic
public-network-only SSRF policy (no hostname allowlist, blocks
private/reserved/loopback/link-local/metadata IPs after DNS resolution).
Also fixes the repo-root resolution in scripts/lib/ts-guard-utils.mjs
which caused lint:tmp:no-raw-channel-fetch to miss extension files
entirely. The guard now walks up to .git instead of hardcoding two parent
traversals, and the allowlist is refreshed with all pre-existing raw
fetch callsites that became visible.
* fix(qqbot): guard image-size probe against SSRF (#63495 ) (thanks @dims)
---------
Co-authored-by: sliverp <870080352@qq.com >
2026-04-09 16:48:04 +08:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 09:22:11 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 05:52:07 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-07 13:44:42 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 08:04:53 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 09:23:52 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 01:38:58 -04:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 06:13:39 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 09:17:29 +01:00
2026-04-09 03:56:22 +01:00
2026-04-07 22:24:32 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 16:48:04 +08:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-03 16:39:47 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-07 20:58:01 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-08 00:09:41 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 02:33:36 -03:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-09 03:56:22 +01:00
2026-04-04 14:13:46 +09:00
2026-03-28 20:22:03 -04:00
2026-04-06 19:15:31 +01:00
2026-04-06 15:38:04 +01:00
2026-04-07 13:09:12 +01:00
2026-04-06 19:15:31 +01:00
08ae021d1f