Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix QQ Bot media download blocked by SSRF allowlist — missing ugcimg.cn and nt.qq.com.cn [3 pull requests, 1 comments, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#65268•Fetched 2026-04-12 13:24:57
View on GitHub
Comments
1
Participants
1
Timeline
6
Reactions
0
Author
thehappyboythehappyboy
Participants
thehappyboythehappyboy
Timeline (top)
cross-referenced ×3referenced ×2commented ×1

Root Cause

The QQBOT_MEDIA_SSRF_POLICY.hostnameAllowlist in extensions/qqbot/src/utils/file-utils.ts is missing domains that QQ Open Platform actually uses:

Current allowlist:

hostnameAllowlist: [
  "*.myqcloud.com",
  "*.qpic.cn",
  "*.qq.com",
  "*.tencentcos.com"
]

Missing domains:

DomainPurpose
qqbot.ugcimg.cnVoice message (.wav) files
multimedia.nt.qq.com.cnMedia download endpoint

Note: *.qq.com does not match nt.qq.com.cn — the TLD is .qq.com.cn, not .qq.com.

Fix Action

Fixed

PR fix notes

PR #65273: fix(qqbot): add missing QQ media domains to SSRF hostname allowlist

Description (problem / solution / changelog)

Summary

QQ Bot voice messages (.wav) and media files fail to download — blocked by the SSRF security policy because the hostname allowlist is missing domains that QQ Open Platform actually uses for media delivery.

Fixes #65268

Root cause

QQBOT_MEDIA_HOSTNAME_ALLOWLIST in extensions/qqbot/src/utils/file-utils.ts:15-20:

const QQBOT_MEDIA_HOSTNAME_ALLOWLIST = [
  "*.myqcloud.com",
  "*.qpic.cn",
  "*.qq.com",        // does NOT match *.qq.com.cn
  "*.tencentcos.com",
];

Missing domains:

DomainPurpose
*.qq.com.cnmultimedia.nt.qq.com.cn — media download endpoint. *.qq.com does not match because the TLD is .qq.com.cn, not .qq.com.
*.ugcimg.cnqqbot.ugcimg.cn — voice message .wav files.

Fix

Add the two missing domains to the allowlist. Alphabetical order preserved.

Scope

  • Files: extensions/qqbot/src/utils/file-utils.ts (+2 lines)
  • oxlint clean
  • Zero competing PRs

Credit to @thehappyboy for the exact domain analysis in #65268.

Changed files

  • extensions/qqbot/src/utils/file-utils.test.ts (modified, +8/-1)
  • extensions/qqbot/src/utils/file-utils.ts (modified, +2/-0)

PR #15: fix(qqbot): add missing domains to SSRF allowlist (fixes #65268)

Description (problem / solution / changelog)

Fixes issue #65268 - QQ Bot voice messages fail to download due to missing SSRF allowlist domains.

Changed files

  • extensions/qqbot/src/utils/file-utils.ts (modified, +50/-15)

PR #65278: fix(qqbot): add missing domains to SSRF allowlist (fixes #65268)

Description (problem / solution / changelog)

Fixes issue #65268 - QQ Bot voice messages fail to download due to missing SSRF allowlist domains.

Changed files

  • extensions/qqbot/src/utils/file-utils.ts (modified, +50/-15)
  • src/agents/pi-tools.before-tool-call.integration.test.ts (added, +16/-0)
  • src/infra/exec-allowlist-pattern.test.ts (modified, +14/-0)
  • src/infra/exec-allowlist-pattern.ts (modified, +15/-3)

Code Example

hostnameAllowlist: [
  "*.myqcloud.com",
  "*.qpic.cn",
  "*.qq.com",
  "*.tencentcos.com"
]

---

hostnameAllowlist: [
  "*.myqcloud.com",
  "*.qpic.cn",
  "*.qq.com",
  "*.qq.com.cn",    // ← add
  "*.tencentcos.com",
  "*.ugcimg.cn"     // ← add
]
RAW_BUFFERClick to expand / collapse

Bug

QQ Bot voice messages (.wav) received via the QQ channel fail to download — blocked by the SSRF security policy.

Root Cause

The QQBOT_MEDIA_SSRF_POLICY.hostnameAllowlist in extensions/qqbot/src/utils/file-utils.ts is missing domains that QQ Open Platform actually uses:

Current allowlist:

hostnameAllowlist: [
  "*.myqcloud.com",
  "*.qpic.cn",
  "*.qq.com",
  "*.tencentcos.com"
]

Missing domains:

DomainPurpose
qqbot.ugcimg.cnVoice message (.wav) files
multimedia.nt.qq.com.cnMedia download endpoint

Note: *.qq.com does not match nt.qq.com.cn — the TLD is .qq.com.cn, not .qq.com.

Suggested Fix

hostnameAllowlist: [
  "*.myqcloud.com",
  "*.qpic.cn",
  "*.qq.com",
  "*.qq.com.cn",    // ← add
  "*.tencentcos.com",
  "*.ugcimg.cn"     // ← add
]

Environment

  • OpenClaw: 2026.4.9 (0512059)
  • OS: macOS (Apple M1)
  • Channel: qqbot (bundled plugin)
  • Impact: Voice messages in QQ DMs cannot be downloaded/played

extent analysis

TL;DR

Update the QQBOT_MEDIA_SSRF_POLICY.hostnameAllowlist in extensions/qqbot/src/utils/file-utils.ts to include the missing domains used by the QQ Open Platform.

Guidance

  • Add *.qq.com.cn and *.ugcimg.cn to the hostnameAllowlist to match the domains used by QQ Open Platform for voice message files and media download endpoints.
  • Verify that the updated allowlist resolves the issue by testing voice message downloads via the QQ channel.
  • Ensure that the QQBOT_MEDIA_SSRF_POLICY.hostnameAllowlist is correctly configured and applied in the production environment.
  • Review the OpenClaw documentation to understand how to properly configure the SSRF security policy for the QQ channel.

Example

hostnameAllowlist: [
  "*.myqcloud.com",
  "*.qpic.cn",
  "*.qq.com",
  "*.qq.com.cn",    // add
  "*.tencentcos.com",
  "*.ugcimg.cn"     // add
]

Notes

The suggested fix assumes that the QQBOT_MEDIA_SSRF_POLICY.hostnameAllowlist is the only configuration that needs to be updated. However, it is essential to review the OpenClaw documentation and the QQ Open Platform documentation to ensure that all necessary configurations are in place.

Recommendation

Apply the suggested fix by updating the QQBOT_MEDIA_SSRF_POLICY.hostnameAllowlist to include the missing domains, as this should resolve the issue with downloading voice messages via the QQ channel.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#ssr#logging issue#authentication issue#prompt issue#agent setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING