fix(discord): add allowRfc2544BenchmarkRange to attachment and sticker downloads

cncoder · cncoder · commit 71484566e37a · 2026-02-25T19:44:13.000+08:00
Discord attachment and sticker downloads fail when the host uses a local proxy with virtual-IP DNS mode (198.18.0.0/15, RFC 2544 benchmark range). The SSRF guard blocks these addresses by default. This follows the same pattern already applied in the Telegram module (src/telegram/bot/delivery.ts:43) by passing ssrfPolicy with allowRfc2544BenchmarkRange: true to fetchRemoteMedia calls. Only Discord-specific call sites are modified to keep the fix scoped: - appendResolvedMediaFromAttachments (voice messages, images, files) - appendResolvedMediaFromStickers Updated corresponding test assertions to expect the new ssrfPolicy parameter. Fixes #25215 Related: #25086, #24973, #24454
diff --git a/src/discord/monitor/message-utils.test.ts b/src/discord/monitor/message-utils.test.ts
@@ -94,6 +94,7 @@ describe("resolveForwardedMediaList", () => {
       filePathHint: attachment.filename,
       maxBytes: 512,
       fetchImpl: undefined,
+      ssrfPolicy: { allowRfc2544BenchmarkRange: true },
     });
     expect(saveMediaBuffer).toHaveBeenCalledTimes(1);
     expect(saveMediaBuffer).toHaveBeenCalledWith(expect.any(Buffer), "image/png", "inbound", 512);
@@ -168,6 +169,7 @@ describe("resolveForwardedMediaList", () => {
       filePathHint: "wave.png",
       maxBytes: 512,
       fetchImpl: undefined,
+      ssrfPolicy: { allowRfc2544BenchmarkRange: true },
     });
     expect(saveMediaBuffer).toHaveBeenCalledTimes(1);
     expect(saveMediaBuffer).toHaveBeenCalledWith(expect.any(Buffer), "image/png", "inbound", 512);
@@ -236,6 +238,7 @@ describe("resolveMediaList", () => {
       filePathHint: "hello.png",
       maxBytes: 512,
       fetchImpl: undefined,
+      ssrfPolicy: { allowRfc2544BenchmarkRange: true },
     });
     expect(saveMediaBuffer).toHaveBeenCalledTimes(1);
     expect(saveMediaBuffer).toHaveBeenCalledWith(expect.any(Buffer), "image/png", "inbound", 512);
diff --git a/src/discord/monitor/message-utils.ts b/src/discord/monitor/message-utils.ts
@@ -228,6 +228,7 @@ async function appendResolvedMediaFromAttachments(params: {
         filePathHint: attachment.filename ?? attachment.url,
         maxBytes: params.maxBytes,
         fetchImpl: params.fetchImpl,
+        ssrfPolicy: { allowRfc2544BenchmarkRange: true },
       });
       const saved = await saveMediaBuffer(
         fetched.buffer,
@@ -320,6 +321,7 @@ async function appendResolvedMediaFromStickers(params: {
           filePathHint: candidate.fileName,
           maxBytes: params.maxBytes,
           fetchImpl: params.fetchImpl,
+          ssrfPolicy: { allowRfc2544BenchmarkRange: true },
         });
         const saved = await saveMediaBuffer(
           fetched.buffer,
