openclaw - 💡(How to fix) Fix Telegram media download blocked by SSRF policy when using proxy [1 participants]

TL;DR

Setting dangerouslyAllowPrivateNetwork to true in the buildTelegramMediaSsrfPolicy() return value may resolve the inbound media download issue when a proxy is configured.

Guidance

• The root cause is identified as the SSRF guard blocking the proxy IP (127.0.0.1) when a proxy is configured, due to dangerouslyAllowPrivateNetwork not being set.
• To verify the issue, check the error message for "Blocked hostname (not in allowlist): 127.0.0.1" when attempting to download media with a proxy configured.
• To mitigate the issue, add dangerouslyAllowPrivateNetwork: true to the policy return value in buildTelegramMediaSsrfPolicy().
• This workaround may introduce security risks, so it's essential to understand the implications of allowing private network access.

Example

// Example of modified buildTelegramMediaSsrfPolicy() return value
return {
  // ... existing policy settings ...
  dangerouslyAllowPrivateNetwork: true
}

Notes

This workaround may not be suitable for all environments, especially those with strict security requirements. It's crucial to evaluate the security implications of allowing private network access.

Recommendation

Apply workaround: add dangerouslyAllowPrivateNetwork: true to the policy return value, as it directly addresses the identified root cause and provides a clear resolution to the issue.