fix(telegram): allow RFC 2544 benchmark IPs in media download SSRF policy (#57452)#57624
Merged
Merged
Conversation
openclaw-barnacle
Bot
added
channel: telegram
Contributor
Greptile SummaryThis PR fixes a targeted SSRF policy misconfiguration in the Telegram media downloader.
Confidence Score: 5/5Safe to merge — the change is a one-line targeted fix that aligns Telegram with Discord/Slack behavior and is fully covered by existing tests. The diff is two changed lines in production code and two updated test assertions. The fix matches the established pattern in Discord and Slack integrations, no logic is altered beyond the single flag, and all tests pass. No P0 or P1 issues were found. No files require special attention.
|
| Filename | Overview |
|---|---|
| extensions/telegram/src/bot/delivery.resolve-media.ts | Single-line fix: allowRfc2544BenchmarkRange changed from false to true, aligning with Discord and Slack SSRF policies. |
| extensions/telegram/src/bot/delivery.resolve-media-retry.test.ts | Two test assertions updated to reflect the new allowRfc2544BenchmarkRange: true value; no other test logic changed. |
Reviews (1): Last reviewed commit: "fix(telegram): allow RFC 2544 benchmark ..." | Re-trigger Greptile
…licy (openclaw#57452) Telegram CDN file servers may resolve to IPs in the RFC 2544 benchmark range (198.18.0.0/15). The SSRF policy blocked these downloads while Discord and Slack correctly allowed them. Set allowRfc2544BenchmarkRange to true to match other channel plugins.
obviyus
force-pushed
the
fix/telegram-media-ssrf-rfc2544
branch
from
March 31, 2026 04:22
32cb0fa to
2330500
Compare
obviyus
approved these changes
Mar 31, 2026
obviyus
left a comment
obviyus
left a comment
Contributor
There was a problem hiding this comment.
Reviewed latest changes; landing now.
Contributor
This was referenced Mar 31, 2026
pgondhi987
pushed a commit
to pgondhi987/openclaw
that referenced
this pull request
Mar 31, 2026
…MoerAI) * fix(telegram): allow RFC 2544 benchmark IPs in media download SSRF policy (openclaw#57452) Telegram CDN file servers may resolve to IPs in the RFC 2544 benchmark range (198.18.0.0/15). The SSRF policy blocked these downloads while Discord and Slack correctly allowed them. Set allowRfc2544BenchmarkRange to true to match other channel plugins. * fix: note Telegram media RFC2544 CDN downloads (openclaw#57624) (thanks @MoerAI) --------- Co-authored-by: Ayaan Zaidi <[email protected]>
pgondhi987
pushed a commit
to pgondhi987/openclaw
that referenced
this pull request
Mar 31, 2026
…MoerAI) * fix(telegram): allow RFC 2544 benchmark IPs in media download SSRF policy (openclaw#57452) Telegram CDN file servers may resolve to IPs in the RFC 2544 benchmark range (198.18.0.0/15). The SSRF policy blocked these downloads while Discord and Slack correctly allowed them. Set allowRfc2544BenchmarkRange to true to match other channel plugins. * fix: note Telegram media RFC2544 CDN downloads (openclaw#57624) (thanks @MoerAI) --------- Co-authored-by: Ayaan Zaidi <[email protected]>
This was referenced Apr 3, 2026
Closed
fix(telegram): add api.telegram.org to SSRF allowedHostnames to fix media download regression
#57444
Closed
lovewanwan
pushed a commit
to lovewanwan/openclaw
that referenced
this pull request
Apr 28, 2026
…MoerAI) * fix(telegram): allow RFC 2544 benchmark IPs in media download SSRF policy (openclaw#57452) Telegram CDN file servers may resolve to IPs in the RFC 2544 benchmark range (198.18.0.0/15). The SSRF policy blocked these downloads while Discord and Slack correctly allowed them. Set allowRfc2544BenchmarkRange to true to match other channel plugins. * fix: note Telegram media RFC2544 CDN downloads (openclaw#57624) (thanks @MoerAI) --------- Co-authored-by: Ayaan Zaidi <[email protected]>
ogt-redknie
pushed a commit
to ogt-redknie/OPENX
that referenced
this pull request
May 2, 2026
…MoerAI) * fix(telegram): allow RFC 2544 benchmark IPs in media download SSRF policy (openclaw#57452) Telegram CDN file servers may resolve to IPs in the RFC 2544 benchmark range (198.18.0.0/15). The SSRF policy blocked these downloads while Discord and Slack correctly allowed them. Set allowRfc2544BenchmarkRange to true to match other channel plugins. * fix: note Telegram media RFC2544 CDN downloads (openclaw#57624) (thanks @MoerAI) --------- Co-authored-by: Ayaan Zaidi <[email protected]>
github-actions Bot
pushed a commit
to Desicool/openclaw
that referenced
this pull request
May 9, 2026
…MoerAI) * fix(telegram): allow RFC 2544 benchmark IPs in media download SSRF policy (openclaw#57452) Telegram CDN file servers may resolve to IPs in the RFC 2544 benchmark range (198.18.0.0/15). The SSRF policy blocked these downloads while Discord and Slack correctly allowed them. Set allowRfc2544BenchmarkRange to true to match other channel plugins. * fix: note Telegram media RFC2544 CDN downloads (openclaw#57624) (thanks @MoerAI) --------- Co-authored-by: Ayaan Zaidi <[email protected]>
github-actions Bot
pushed a commit
to Desicool/openclaw
that referenced
this pull request
May 24, 2026
…MoerAI) * fix(telegram): allow RFC 2544 benchmark IPs in media download SSRF policy (openclaw#57452) Telegram CDN file servers may resolve to IPs in the RFC 2544 benchmark range (198.18.0.0/15). The SSRF policy blocked these downloads while Discord and Slack correctly allowed them. Set allowRfc2544BenchmarkRange to true to match other channel plugins. * fix: note Telegram media RFC2544 CDN downloads (openclaw#57624) (thanks @MoerAI) --------- Co-authored-by: Ayaan Zaidi <[email protected]>
Nachx639
pushed a commit
to Nachx639/clawdbot
that referenced
this pull request
Jun 17, 2026
…MoerAI) * fix(telegram): allow RFC 2544 benchmark IPs in media download SSRF policy (openclaw#57452) Telegram CDN file servers may resolve to IPs in the RFC 2544 benchmark range (198.18.0.0/15). The SSRF policy blocked these downloads while Discord and Slack correctly allowed them. Set allowRfc2544BenchmarkRange to true to match other channel plugins. * fix: note Telegram media RFC2544 CDN downloads (openclaw#57624) (thanks @MoerAI) --------- Co-authored-by: Ayaan Zaidi <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Telegram CDN file servers sometimes resolve to IPs in the RFC 2544 benchmark range (198.18.0.0/15). The Telegram SSRF policy set
allowRfc2544BenchmarkRange: false, blocking legitimate media downloads and causing "Failed to download media" errors for voice messages, PDFs, and other files.Root Cause
buildTelegramMediaSsrfPolicy()inextensions/telegram/src/bot/delivery.resolve-media.tssetallowRfc2544BenchmarkRange: falsewhile Discord and Slack both set it totrue. When Telegram's CDN servers resolve to addresses in the 198.18.0.0/15 range, the SSRF check rejects the download.Changes
extensions/telegram/src/bot/delivery.resolve-media.ts: changeallowRfc2544BenchmarkRangefromfalsetotrue, matching Discord and Slack behaviorextensions/telegram/src/bot/delivery.resolve-media-retry.test.ts: update test expectations to matchTest
All 23 tests pass in
delivery.resolve-media-retry.test.ts.Closes #57452
Closes #57564