Dealing with Fake IP when using Clash

[glfruit]

I run wallabag behind a Clash proxy, the problem is Clash always returns fake ip for any domain which wallbag uses to fetch content. Obviously this can't work because fake ip is just a private network address. Is there any way to make wallbag work properly with Clash?

[9k001]

I have the same problem as you. Have you made any progress on this problem?

[9k001]

After my constant search, I found the cause of the problem.
At the beginning of the period, a discussion of security took place here. Server Side Request Forgery (SSRF)
The author of wallabag wrote a security plug-in . httplug-ssrf-plugin
Among them, some blocked IP are written here. Options.php
So, my solution is to comment out the settings about FakeIP.

# cp /var/www/wallabag/vendor/j0k3r/httplug-ssrf-plugin/src/Options.php /var/www/wallabag/vendor/j0k3r/httplug-ssrf-plugin/src/Options.php.bak
# vi /var/www/wallabag/vendor/j0k3r/httplug-ssrf-plugin/src/Options.php

        'blacklist' => [
            'ip' => [
                '0.0.0.0/8',
                '10.0.0.0/8',
                '100.64.0.0/10',
                '127.0.0.0/8',
                '169.254.0.0/16',
                '172.16.0.0/12',
                '192.0.0.0/29',
                '192.0.2.0/24',
                '192.88.99.0/24',
                '192.168.0.0/16',
                /**'198.18.0.0/15',*/
                '198.51.100.0/24',
                '203.0.113.0/24',
                '224.0.0.0/4',
                '240.0.0.0/4',
            ],

But I still want @j0k3r to pay attention to this problem. Modify the relevant code. After all, mounting files is only a temporary solution.

[j0k3r]

Yeah maybe we should allow end user to configure the blacklist ip array.

[9k001]

Yeah maybe we should allow end user to configure the blacklist ip array.

I think having a switch is a better choice. If it is a configuration item, there may be problems with input parameters.

[j0k3r]

What do you mean by having a switch?

[9k001]

What do you mean by having a switch?

Well, I use translation software. The switch has a button, which is opened to add the security setting, and off to cancel the security setting.