PicoClaw
PicoClaw puts one SSRF-safe client under inbound media
Three PicoClaw patches route generic, WeCom and Weixin media downloads through a shared safe HTTP client that rejects private targets. The cluster closes the same server-side request-forgery boundary across channel adapters rather than fixing one URL path at a time.
sipeed/picoclaw PR #3322 is the inspected primary source: “fix(channels): block private targets on inbound media downloads.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- sipeed/picoclaw PR #3322 was created 2026-08-09T06:10:57Z and was open at inspection; its title is “fix(channels): block private targets on inbound media downloads.” - sipeed/picoclaw PR #3323 was created 2026-08-09T07:00:47Z and was open at inspection; its title is “fix(wecom): use CreateSafeHTTPClient for media downloads.” - sipeed/picoclaw PR #3324 was created 2026-08-09T07:07:41Z and was open at inspection; its title is “fix(weixin): use CreateSafeHTTPClient for media downloads.” - The repository reported 29838 stars, 55 open issues, default branch main, and last push 2026-08-07T18:18:20Z. - The latest tagged-release baseline checked was nightly published 2026-07-02T01:26:53Z.
What changed
sipeed/picoclaw PR #3322 reports: Summary utils.DownloadFile already supports SSRF hardening via BlockPrivateTargets (safe dial + redirect re-check). OneBot used it; QQ / Telegram / Discord / LINE / Slack inbound attachment downloads did not, so a crafted media URL could still reach loopback, link-local, or RFC1918 (including cloud metadata) through redirects. This PR enables BlockPrivateTargets: true on those channel download paths (parity with OneBot). Test plan [x] go test./pkg/utils/ -count=1 (existing TestDownloadFile_BlockPrivateTargetsBlocksRedirectToLoopback) [ ] CI green Tip: 49183d7 Made with Cursor
sipeed/picoclaw PR #3323 reports: Summary WeCom built mediaClient as a plain http.Client, so inbound storeRemoteMedia and outbound downloadRemoteMediaToTemp followed redirects onto loopback / private hosts. Construct the client with utils.CreateSafeHTTPClient and ValidateSafeHTTPURL before fetch. Sibling of #3322 (QQ/Telegram/Discord/LINE/Slack DownloadFile private block); WeCom uses a separate media client path. Test plan [x] go test./pkg/channels/wecom/ -count=1 (includes new redirect-to-private reject) [ ] CI Made with Cursor
sipeed/picoclaw PR #3324 reports: Summary Weixin CDN/remote media used the plain iLink api.HttpClient, so redirects could reach loopback / private hosts. Add a dedicated mediaClient via utils.CreateSafeHTTPClient and ValidateSafeHTTPURL before media GET/POST. Leave the iLink API client unchanged (BaseURL/proxy for control-plane calls). Sibling of #3323 (WeCom) and #3322 (DownloadFile channels). Test plan [x] go test./pkg/channels/weixin/ -count=1 (includes new redirect-to-private reject) [ ] CI Made with Cursor
Why it matters
Inbound media URLs are attacker-controlled network instructions. A channel-by-channel patch leaves the next adapter as the bypass; the safe client must own redirect and destination policy centrally. The operator test is whether visible output, retained state and authority still describe the same event after retries, background work or restart.
Current
The primary record was open when captured on 2026-08-10. The tagged-release baseline was nightly published 2026-07-02T01:26:53Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/sipeed/picoclaw/pull/3322. Supporting records are https://github.com/sipeed/picoclaw/pull/3323 and https://github.com/sipeed/picoclaw/pull/3324. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Resolve and validate every redirect hop, reject private and link-local ranges, bound response size and time, and keep adapter code from constructing its own unrestricted client. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.