opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(config): add allow_private_hosts option to control access to local/private IPs

Browse source
This commit is contained in:
Anric 2026-03-13 11:57:22 +08:00
parent 83e24e8ceb
commit 07fbe05ece
5 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
config/config.example.json
View file

@ -328,7 +328,8 @@
"search_engine": "search_std", "search_engine": "search_std",
"max_results": 5 "max_results": 5
}, },
"fetch_limit_bytes": 10485760 "fetch_limit_bytes": 10485760,
"allow_private_hosts": false
}, },
"cron": { "cron": {
"enabled": true, "enabled": true,

3
pkg/agent/loop.go
View file

@ -114,6 +114,9 @@ func registerSharedTools(
registry *AgentRegistry, registry *AgentRegistry,
provider providers.LLMProvider, provider providers.LLMProvider,
) { ) {
// Apply global settings that affect tool behavior.
tools.SetAllowPrivateWebFetchHosts(cfg.Tools.Web.AllowPrivateHosts)
for _, agentID := range registry.ListAgentIDs() { for _, agentID := range registry.ListAgentIDs() {
agent, ok := registry.GetAgent(agentID) agent, ok := registry.GetAgent(agentID)
if !ok { if !ok {

3
pkg/config/config.go
View file

@ -692,6 +692,9 @@ type WebToolsConfig struct {
// For authenticated proxies, prefer HTTP_PROXY/HTTPS_PROXY env vars instead of embedding credentials in config. // For authenticated proxies, prefer HTTP_PROXY/HTTPS_PROXY env vars instead of embedding credentials in config.
Proxy string `json:"proxy,omitempty" env:"PICOCLAW_TOOLS_WEB_PROXY"` Proxy string `json:"proxy,omitempty" env:"PICOCLAW_TOOLS_WEB_PROXY"`
FetchLimitBytes int64 `json:"fetch_limit_bytes,omitempty" env:"PICOCLAW_TOOLS_WEB_FETCH_LIMIT_BYTES"` FetchLimitBytes int64 `json:"fetch_limit_bytes,omitempty" env:"PICOCLAW_TOOLS_WEB_FETCH_LIMIT_BYTES"`
// AllowPrivateHosts controls whether web_fetch may connect to local/private IPs.
// Defaults to false to reduce SSRF exposure.
AllowPrivateHosts bool `json:"allow_private_hosts" env:"PICOCLAW_TOOLS_WEB_ALLOW_PRIVATE_HOSTS"`
} }
type CronToolsConfig struct { type CronToolsConfig struct {

1
pkg/config/defaults.go
View file

@ -395,6 +395,7 @@ func DefaultConfig() *Config {
}, },
Proxy: "", Proxy: "",
FetchLimitBytes: 10 * 1024 * 1024, // 10MB by default FetchLimitBytes: 10 * 1024 * 1024, // 10MB by default
AllowPrivateHosts: false,
Brave: BraveConfig{ Brave: BraveConfig{
Enabled: false, Enabled: false,
APIKey: "", APIKey: "",

6
pkg/tools/web.go
View file

@ -823,6 +823,12 @@ func NewWebFetchTool(maxChars int, fetchLimitBytes int64) (*WebFetchTool, error)
// This is false in normal runtime to reduce SSRF exposure, and tests can override it temporarily. // This is false in normal runtime to reduce SSRF exposure, and tests can override it temporarily.
var allowPrivateWebFetchHosts atomic.Bool var allowPrivateWebFetchHosts atomic.Bool
// SetAllowPrivateWebFetchHosts configures whether the web_fetch tool may access local/private IPs.
// This is normally false to reduce SSRF attack surface.
func SetAllowPrivateWebFetchHosts(allow bool) {
allowPrivateWebFetchHosts.Store(allow)
}
func NewWebFetchToolWithProxy(maxChars int, proxy string, fetchLimitBytes int64) (*WebFetchTool, error) { func NewWebFetchToolWithProxy(maxChars int, proxy string, fetchLimitBytes int64) (*WebFetchTool, error) {
if maxChars <= 0 { if maxChars <= 0 {
maxChars = defaultMaxChars maxChars = defaultMaxChars