Eugeniusz Gilewski 0cd4afeafd fix(security): guard remaining preflighted HTTP fetches ... Several platform fetch paths called is_safe_url before constructing ordinary httpx clients, leaving a second DNS lookup at connection time. This preserved the rebinding window for Slack batch images, Feishu documents, Telegram URL-photo fallback, and WeCom remote media. Route each path through create_ssrf_safe_async_client and the shared redirect guard so direct connections validate and dial vetted IPs while configured proxies remain an explicit trusted egress boundary. Add per-path regressions that change DNS from public at preflight to metadata at connect time. The Skills Hub provenance fixture intentionally serves content over loopback. Opt that test-scoped server into private-address access so it keeps exercising the real HTTP transport without weakening production blocking. Related #8033 Co-authored-by: teknium1 <127238744+teknium1@users.noreply.github.com>		2026-07-23 11:44:43 -07:00
..
__init__.py	refactor(gateway): migrate slack/dingtalk/whatsapp/matrix/feishu/telegram/wecom/email/sms adapters to bundled plugins	2026-06-20 10:26:45 -07:00
adapter.py	fix(security): guard remaining preflighted HTTP fetches	2026-07-23 11:44:43 -07:00
plugin.yaml	refactor(gateway): migrate slack/dingtalk/whatsapp/matrix/feishu/telegram/wecom/email/sms adapters to bundled plugins	2026-06-20 10:26:45 -07:00
telegram_ids.py	fix(telegram): accept @username chat_id in delivery paths (#13206)	2026-06-27 04:01:58 -07:00
telegram_network.py	fix(telegram): diagnose blocked-loop init hangs, unbind DoH from system DNS	2026-07-14 17:09:50 +05:30