OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
Guarded fetch redirect handling in `fetchWithSsrFGuard` can replay unsafe request bodies and related body-describing headers across cross-origin redirects, especially on redirect-preserving methods/statuses such as 307/308.
src/infra/net/fetch-guard.ts
This file defines `fetchWithSsrFGuard`; its redirect-following logic is the sink that decides whether the original method, body, and headers are preserved when a redirect crosses origins.
src/infra/net/fetch-guard.ssrf.test.ts
The SSRF guard regression tests are the closest ground truth for the affected redirect cases and can help identify the exact cross-origin redirect replay behavior the advisory describes.