@@ -0,0 +1,67 @@
1+import {
2+buildHostnameAllowlistPolicyFromSuffixAllowlist,
3+isHttpsUrlAllowedByHostnameSuffixAllowlist,
4+normalizeHostnameSuffixAllowlist,
5+type SsrFPolicy,
6+} from "openclaw/plugin-sdk/ssrf-policy";
7+8+const DEFAULT_BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST = [
9+// Microsoft Teams Bot Framework serviceUrl endpoints documented for
10+// commercial, GCC, GCC High, and DOD clouds. These are the only hosts that may
11+// receive Bot Framework service tokens from this plugin.
12+"smba.trafficmanager.net",
13+"smba.infra.gcc.teams.microsoft.com",
14+"smba.infra.gov.teams.microsoft.us",
15+"smba.infra.dod.teams.microsoft.us",
16+] as const;
17+18+export const BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST = normalizeHostnameSuffixAllowlist(
19+DEFAULT_BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST,
20+);
21+22+const serviceUrlSsrfPolicy = buildHostnameAllowlistPolicyFromSuffixAllowlist(
23+BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST,
24+);
25+26+if (!serviceUrlSsrfPolicy) {
27+throw new Error("Microsoft Teams Bot Framework serviceUrl allowlist is empty");
28+}
29+30+export const BOT_FRAMEWORK_SERVICE_URL_SSRF_POLICY: SsrFPolicy = serviceUrlSsrfPolicy;
31+32+export function describeBotFrameworkServiceUrlHost(serviceUrl: string): string {
33+try {
34+const parsed = new URL(serviceUrl.trim());
35+return parsed.hostname || "invalid-url";
36+} catch {
37+return "invalid-url";
38+}
39+}
40+41+export function isAllowedBotFrameworkServiceUrl(serviceUrl: unknown): serviceUrl is string {
42+if (typeof serviceUrl !== "string") {
43+return false;
44+}
45+const trimmed = serviceUrl.trim();
46+return Boolean(
47+trimmed &&
48+isHttpsUrlAllowedByHostnameSuffixAllowlist(trimmed, BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST),
49+);
50+}
51+52+export function tryNormalizeBotFrameworkServiceUrl(serviceUrl: unknown): string | undefined {
53+if (!isAllowedBotFrameworkServiceUrl(serviceUrl)) {
54+return undefined;
55+}
56+return serviceUrl.trim().replace(/\/+$/, "");
57+}
58+59+export function normalizeBotFrameworkServiceUrl(serviceUrl: string): string {
60+const normalized = tryNormalizeBotFrameworkServiceUrl(serviceUrl);
61+if (normalized) {
62+return normalized;
63+}
64+throw new Error(
65+`Blocked Microsoft Teams serviceUrl host: ${describeBotFrameworkServiceUrlHost(serviceUrl)}`,
66+);
67+}
此內容由慣性聚合(RSS閱讀器)自動聚合整理，僅供閱讀參考。 原文來自 — 版權歸原作者所有。