openclaw - 💡(How to fix) Fix Telegram media download fails: SSRF blocks 'api.telegram.org' when using proxy [1 participants]

Bug Description

When a Telegram bot receives an image from a user and attempts to download it via the Bot API getFile endpoint, OpenClaw's SSRF protection blocks the request with:

[security] blocked URL fetch (url-fetch) target=https://api.telegram.org/file/bot.../photos/file_0.jpg reason=Blocked hostname (not in allowlist): 127.0.0.1

The target URL is api.telegram.org but the SSRF check is seeing the proxy hostname 127.0.0.1 as the request target, triggering the private IP block.

Environment

• OpenClaw version: 2026.4.2 (d74a122)
• OS: macOS 15.6.1 (Darwin arm64)
• Node: v25.6.1
• Telegram bot configured with proxy: http://127.0.0.1:15236 (Veee)

Steps to Reproduce

1. Configure a Telegram bot with a proxy URL in channels.telegram.accounts.<accountId>.proxy
2. Send an image to the bot via Telegram DM or group
3. The bot shows: "⚠️ Failed to download media. Please try again."
4. Gateway error log shows: Blocked hostname (not in allowlist): 127.0.0.1

Expected Behavior

Telegram media downloads should succeed when a proxy is configured. The SSRF check should see the target hostname (api.telegram.org) not the proxy's hostname.

Root Cause Analysis

The SSRF protection logic appears to be incorrectly using the proxy hostname (127.0.0.1) as the target for SSRF hostname allowlist checking, instead of the actual destination api.telegram.org.

Additional Context

• curl with the same proxy successfully downloads Telegram files (returns HTTP 200) — confirming the proxy itself works
• The issue occurs on all Telegram accounts/bots when they have proxy configured
• A workaround using /etc/hosts to force IPv4 for api.telegram.org helps but does not fully resolve the issue since the SSRF check is matching the proxy hostname, not the target

Config Snippet

{
  "channels": {
    "telegram": {
      "accounts": {
        "prostudy": {
          "botToken": "...",
          "proxy": "http://127.0.0.1:15236"
        }
      }
    }
  }
}

Suggested Fix

Telegram bot media downloads should either:

1. Bypass SSRF check for api.telegram.org (trusted Telegram Bot API endpoint), or
2. Fix the SSRF logic to correctly use the target URL hostname rather than the proxy hostname when checking against the allowlist