fix(image-gen): propagate ssrfPolicy into provider HTTP calls (#79716)

hclsys · claude · hclsys · commit 15efb16757f7 · 2026-05-09T16:06:27.000+08:00
Image-generation providers called fetchWithSsrFGuard without inheriting
the agent-level ssrfPolicy (tools.web.fetch.ssrfPolicy), so
allowRfc2544BenchmarkRange had no effect on provider requests even when
explicitly configured.  Clash TUN / Surge fake-IP setups (198.18.0.0/15)
were blocked despite the flag being true.

Changes:
- ImageGenerationRequest: add optional ssrfPolicy field
- GenerateImageParams: add optional ssrfPolicy field
- runtime.ts: thread ssrfPolicy into provider.generateImage()
- image-generate-tool.ts: pass remoteMediaSsrfPolicy to generateImage()
- shared.ts resolveGuardedPostRequestOptions: accept full ssrfPolicy and
  merge with allowPrivateNetwork instead of always truncating to {allowPrivateNetwork:true}
- postJsonRequest / postMultipartRequest: expose ssrfPolicy param
- openai-compatible-image-provider.ts: forward req.ssrfPolicy
- extensions/openai/image-generation-provider.ts: forward req.ssrfPolicy
  in both JSON and multipart request paths

Co-Authored-By: Claude Sonnet 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/extensions/openai/image-generation-provider.test.ts b/extensions/openai/image-generation-provider.test.ts
@@ -364,6 +364,25 @@ describe("openai image generation provider", () => {
     expect(result.images).toHaveLength(1);
   });
 
+  it("propagates req.ssrfPolicy to postJsonRequest so allowRfc2544BenchmarkRange reaches the HTTP guard", async () => {
+    mockGeneratedPngResponse();
+
+    const provider = buildOpenAIImageGenerationProvider();
+    await provider.generateImage({
+      provider: "openai",
+      model: "gpt-image-2",
+      prompt: "test",
+      cfg: {},
+      ssrfPolicy: { allowRfc2544BenchmarkRange: true },
+    });
+
+    expect(postJsonRequestMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        ssrfPolicy: { allowRfc2544BenchmarkRange: true },
+      }),
+    );
+  });
+
   it("forwards generation count and custom size overrides", async () => {
     mockGeneratedPngResponse();
 
diff --git a/extensions/openai/image-generation-provider.ts b/extensions/openai/image-generation-provider.ts
@@ -842,6 +842,7 @@ export function buildOpenAIImageGenerationProvider(): ImageGenerationProvider {
               timeoutMs,
               fetchFn: fetch,
               allowPrivateNetwork,
+              ssrfPolicy: req.ssrfPolicy,
               dispatcherPolicy,
             });
           })()
@@ -864,6 +865,7 @@ export function buildOpenAIImageGenerationProvider(): ImageGenerationProvider {
               timeoutMs,
               fetchFn: fetch,
               allowPrivateNetwork,
+              ssrfPolicy: req.ssrfPolicy,
               dispatcherPolicy,
             });
           })();
diff --git a/src/agents/tools/image-generate-tool.ts b/src/agents/tools/image-generate-tool.ts
@@ -742,6 +742,7 @@ export function createImageGenerateTool(options?: {
         inputImages,
         timeoutMs,
         providerOptions,
+        ssrfPolicy: remoteMediaSsrfPolicy,
       });
       const ignoredOverrides = result.ignoredOverrides ?? [];
       const displayProvider = sanitizeInlineDirectiveText(result.provider);
diff --git a/src/image-generation/openai-compatible-image-provider.ts b/src/image-generation/openai-compatible-image-provider.ts
@@ -234,6 +234,7 @@ export function createOpenAiCompatibleImageGenerationProvider(
               timeoutMs,
               fetchFn: fetch,
               allowPrivateNetwork: resolvedAllowPrivateNetwork,
+              ssrfPolicy: req.ssrfPolicy,
               dispatcherPolicy,
             })
           : postJsonRequest({
@@ -247,6 +248,7 @@ export function createOpenAiCompatibleImageGenerationProvider(
               timeoutMs,
               fetchFn: fetch,
               allowPrivateNetwork: resolvedAllowPrivateNetwork,
+              ssrfPolicy: req.ssrfPolicy,
               dispatcherPolicy,
             });
 
diff --git a/src/image-generation/runtime-types.ts b/src/image-generation/runtime-types.ts
@@ -1,6 +1,7 @@
 import type { AuthProfileStore } from "../agents/auth-profiles/types.js";
 import type { FallbackAttempt } from "../agents/model-fallback.types.js";
 import type { OpenClawConfig } from "../config/types.openclaw.js";
+import type { SsrFPolicy } from "../infra/net/ssrf.js";
 import type {
   GeneratedImageAsset,
   ImageGenerationBackground,
@@ -32,6 +33,8 @@ export type GenerateImageParams = {
   /** Optional per-request provider timeout in milliseconds. */
   timeoutMs?: number;
   providerOptions?: ImageGenerationProviderOptions;
+  /** SSRF policy to propagate into image-generation provider HTTP calls. */
+  ssrfPolicy?: SsrFPolicy;
 };
 
 export type GenerateImageRuntimeResult = {
diff --git a/src/image-generation/runtime.ts b/src/image-generation/runtime.ts
@@ -118,6 +118,7 @@ export async function generateImage(
         inputImages: params.inputImages,
         ...(timeoutMs !== undefined ? { timeoutMs } : {}),
         providerOptions: params.providerOptions,
+        ssrfPolicy: params.ssrfPolicy,
       });
       if (!Array.isArray(result.images) || result.images.length === 0) {
         throw new Error("Image generation provider returned no images.");
diff --git a/src/image-generation/types.ts b/src/image-generation/types.ts
@@ -1,5 +1,6 @@
 import type { AuthProfileStore } from "../agents/auth-profiles/types.js";
 import type { OpenClawConfig } from "../config/types.openclaw.js";
+import type { SsrFPolicy } from "../infra/net/ssrf.js";
 import type { MediaNormalizationEntry } from "../media-generation/normalization.types.js";
 
 export type GeneratedImageAsset = {
@@ -75,6 +76,7 @@ export type ImageGenerationRequest = {
   background?: ImageGenerationBackground;
   inputImages?: ImageGenerationSourceImage[];
   providerOptions?: ImageGenerationProviderOptions;
+  ssrfPolicy?: SsrFPolicy;
 };
 
 export type ImageGenerationResult = {
diff --git a/src/media-understanding/shared.ts b/src/media-understanding/shared.ts
@@ -324,21 +324,32 @@ type GuardedPostRequestOptions = NonNullable<Parameters<typeof fetchWithTimeoutG
 function resolveGuardedPostRequestOptions(params: {
   pinDns?: boolean;
   allowPrivateNetwork?: boolean;
+  ssrfPolicy?: SsrFPolicy;
   dispatcherPolicy?: PinnedDispatcherPolicy;
   auditContext?: string;
   mode?: GuardedFetchMode;
 }): GuardedPostRequestOptions | undefined {
   if (
     !params.allowPrivateNetwork &&
+    !params.ssrfPolicy &&
     !params.dispatcherPolicy &&
     params.pinDns === undefined &&
     !params.auditContext &&
     params.mode === undefined
   ) {
     return undefined;
   }
+  // Merge allowPrivateNetwork into ssrfPolicy when both are provided so callers
+  // that use the boolean shorthand still get the flag set.
+  const mergedSsrfPolicy: SsrFPolicy | undefined = params.ssrfPolicy
+    ? params.allowPrivateNetwork
+      ? { ...params.ssrfPolicy, allowPrivateNetwork: true }
+      : params.ssrfPolicy
+    : params.allowPrivateNetwork
+      ? { allowPrivateNetwork: true }
+      : undefined;
   return {
-    ...(params.allowPrivateNetwork ? { ssrfPolicy: { allowPrivateNetwork: true } } : {}),
+    ...(mergedSsrfPolicy ? { ssrfPolicy: mergedSsrfPolicy } : {}),
     ...(params.pinDns !== undefined ? { pinDns: params.pinDns } : {}),
     ...(params.dispatcherPolicy ? { dispatcherPolicy: params.dispatcherPolicy } : {}),
     ...(params.auditContext ? { auditContext: params.auditContext } : {}),
@@ -384,6 +395,8 @@ export async function postJsonRequest(params: {
   fetchFn: typeof fetch;
   pinDns?: boolean;
   allowPrivateNetwork?: boolean;
+  /** Full SSRF policy. When provided, merged with allowPrivateNetwork. */
+  ssrfPolicy?: SsrFPolicy;
   dispatcherPolicy?: PinnedDispatcherPolicy;
   auditContext?: string;
   /**
@@ -414,6 +427,8 @@ export async function postMultipartRequest(params: {
   fetchFn: typeof fetch;
   pinDns?: boolean;
   allowPrivateNetwork?: boolean;
+  /** Full SSRF policy. When provided, merged with allowPrivateNetwork. */
+  ssrfPolicy?: SsrFPolicy;
   dispatcherPolicy?: PinnedDispatcherPolicy;
   auditContext?: string;
   /**
