Summary

src/agents/tools/web-guarded-fetch.ts:10–13 defines a single SSRF policy used by every web search provider in OpenClaw:

```typescript const WEB_TOOLS_TRUSTED_NETWORK_SSRF_POLICY: SsrFPolicy = { dangerouslyAllowPrivateNetwork: true, allowRfc2544BenchmarkRange: true, }; ```

This policy is applied via withTrustedWebToolsEndpoint → withTrustedWebSearchEndpoint / postTrustedWebToolsJson, which is called by all 10 bundled web search providers:

• extensions/duckduckgo/src/ddg-client.ts
• extensions/brave/src/brave-web-search-provider.runtime.ts
• extensions/searxng/src/searxng-client.ts
• extensions/perplexity/src/perplexity-web-search-provider.runtime.ts
• extensions/moonshot/src/kimi-web-search-provider.runtime.ts
• extensions/xai/src/x-search-shared.ts, web-search-shared.ts, code-execution-shared.ts
• extensions/exa/src/exa-web-search-provider.runtime.ts
• extensions/google/src/gemini-web-search-provider.runtime.ts
• extensions/tavily/src/tavily-client.ts
• extensions/minimax/src/minimax-web-search-provider.runtime.ts

The policy is also re-exported via the plugin SDK at src/plugin-sdk/provider-web-fetch.ts:10, making it available to third-party plugins.

Why dangerouslyAllowPrivateNetwork exists

SearXNG is a self-hosted search engine — users configure it at a private IP like http://192.168.1.10:8080. That is the only provider where private network access is intentional and expected.

Impact

Every web search call made by DuckDuckGo, Brave, Perplexity, xAI, Exa, Gemini, Tavily, Moonshot, and MiniMax can follow HTTP redirects or reach private RFC-1918 addresses (10.x.x.x, 172.16–31.x.x, 192.168.x.x). In a cloud or Docker deployment this includes:

• Internal metadata endpoints (e.g. http://169.254.169.254/ on AWS/GCP/Azure — link-local, not RFC-1918, but relevant in practice)
• Other containers on the same Docker network
• Internal APIs, admin panels, and databases not intended to be reachable from the agent

The trigger does not require a code change — a malicious web search result that returns a redirect to an internal URL, or a user instruction to fetch a specific URL, is sufficient.

Fix

Split the policy so dangerouslyAllowPrivateNetwork is only active for providers where the endpoint URL is user-configured as a private address (SearXNG, and any future self-hosted provider). Cloud providers with fixed public API endpoints should use the strict policy.

Option A — per-provider opt-in: ```typescript // web-guarded-fetch.ts const STRICT_WEB_TOOLS_SSRF_POLICY: SsrFPolicy = {}; const SELF_HOSTED_WEB_TOOLS_SSRF_POLICY: SsrFPolicy = { dangerouslyAllowPrivateNetwork: true, };

export async function withTrustedWebToolsEndpoint(...) { /* uses STRICT / } export async function withSelfHostedWebToolsEndpoint(...) { / uses SELF_HOSTED */ } ```

Then SearXNG switches to withSelfHostedWebToolsEndpoint; all other providers stay on withTrustedWebToolsEndpoint with the strict policy.

Option B — URL-based guard: Before making the request in withTrustedWebToolsEndpoint, check whether the URL resolves to a private address and reject it unless the caller has explicitly opted into private network access.

Affected files

• src/agents/tools/web-guarded-fetch.ts:10–13 — policy definition
• src/agents/tools/web-search-provider-common.ts:85–86, 108–109 — shared call sites
• src/plugin-sdk/provider-web-fetch.ts:10–11 — SDK re-export
• All 10 extension files listed above