JuliusBrussee/caveman · error

githubapp: base_url rejected by SSRF guard: %w

Error message

githubapp: base_url rejected by SSRF guard: %w

What it means

Fires in githubapp.New() when the configured base URL is rejected by the SSRF guard's pre-flight host check — the caller supplied a custom (GHE) base URL whose host is not an allowed GitHub endpoint. This prevents redirecting App credentials to attacker-controlled hosts.

Source

Thrown at shared/platform/githubapp/githubapp.go:89

	if len(cfg.PrivateKeyPEM) == 0 {
		return nil, fmt.Errorf("githubapp: private key PEM is required")
	}
	key, err := parseRSAPrivateKey(cfg.PrivateKeyPEM)
	if err != nil {
		return nil, err
	}
	base := strings.TrimRight(strings.TrimSpace(cfg.BaseURL), "/")
	if base == "" {
		base = defaultBaseURL
	}
	client := cfg.HTTPClient
	if client == nil {
		// Production path: SSRF-guarded client + pre-flight host check on a custom
		// (GHE) base. When a caller injects a client (tests), it owns the host policy,
		// so we skip the pre-flight — but production never injects one.
		if base != defaultBaseURL {
			if err := ssrf.ValidateURL(context.Background(), base, ssrf.ManagedConfig()); err != nil {
				return nil, fmt.Errorf("githubapp: base_url rejected by SSRF guard: %w", err)
			}
		}
		client = ssrf.NewHTTPClient(ssrf.ManagedConfig())
		client.Timeout = 20 * time.Second
	}
	return &App{
		appID:         strings.TrimSpace(cfg.AppID),
		slug:          strings.TrimSpace(cfg.AppSlug),
		privateKey:    key,
		webhookSecret: cfg.WebhookSecret,
		baseURL:       base,
		httpClient:    client,
	}, nil
}

// Slug returns the App slug used to build the install URL.
func (a *App) Slug() string { return a.slug }

View on GitHub (pinned to 766dce6b13)

Solutions

1. Use the standard https://api.github.com base or a legitimate GitHub Enterprise Server host allowed by the SSRF policy
2. Correct typos or schemes in BaseURL (must be a proper https URL) and re-check the allowlist configuration

When it happens

Trigger: Thrown at shared/platform/githubapp/githubapp.go:89 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/10e0589a6dbd693d. Report an issue: GitHub.