openclaw - 💡(How to fix) Fix Bug: QQBot plugin token/API requests blocked by SSRF guard in fake-IP proxy environments (Surge/Clash) [1 participants]

Error Log

[qqbot] [qqbot:default] Connection failed: Network error getting access_token: Blocked: resolves to private/internal/special-use IP address

TL;DR

• Add the ssrfPolicy parameter to fetchWithSsrFGuard calls in api-*.js to allow requests to pass through the SSRF guard when using a fake-IP proxy.

Guidance

• Identify the fetchWithSsrFGuard calls in api-*.js that are missing the ssrfPolicy parameter and add it to allow requests to *.qq.com and enable allowRfc2544BenchmarkRange.
• Verify that the ssrfPolicy is correctly applied by checking the request logs for successful requests to bots.qq.com.
• Consider applying the same QQBOT_MEDIA_SSRF_POLICY to token and API requests in the QQBot plugin for consistency and to ensure fake-IP proxy compatibility.
• Test the workaround by running the QQBot plugin behind a fake-IP proxy and verifying that access tokens are obtained and API requests are successful.

Example

const guarded = await fetchWithSsrFGuard({
    url: TOKEN_URL,
    init: { method: "POST", headers, body },
    auditContext: "qqbot.token",
    ssrfPolicy: {
        hostnameAllowlist: ["*.qq.com"],
        allowRfc2544BenchmarkRange: true
    }
});

Notes

• The provided workaround will be overwritten on upgrade, so a permanent fix should be applied to the QQBot plugin.
• The Telegram plugin's dangerouslyAllowPrivateNetwork setting may serve as a reference for implementing equivalent support in the QQBot plugin.

Recommendation

• Apply the workaround by adding the ssrfPolicy parameter to fetchWithSsrFGuard calls in api-*.js to allow requests to pass through the SSRF guard when using a fake-IP proxy, as this provides a temporary solution until a permanent fix is implemented.