JuliusBrussee/caveman · error

ssrf: invalid host

Error message

ssrf: invalid host

What it means

Error "ssrf: invalid host" thrown in JuliusBrussee/caveman.

Source

Thrown at shared/platform/ssrf/ssrf.go:244

	for _, ia := range addrs {
		a, ok := netip.AddrFromSlice(ia.IP)
		if !ok {
			return fmt.Errorf("ssrf: could not parse resolved IP %v for host %q", ia.IP, host)
		}
		a = a.Unmap() // normalise ::ffff:x.x.x.x → x.x.x.x
		if err := checkAddr(a, host, port, cfg); err != nil {
			return err
		}
	}
	return nil
}

// validateHostInput rejects URL/userinfo-shaped values before they reach DNS
// or an error formatter. IP literals (including zoned IPv6) are handled by
// netip.ParseAddr and may contain colons or a zone identifier.
func validateHostInput(host string) error {
	if host == "" {
		return errors.New("ssrf: invalid host")
	}
	if _, err := netip.ParseAddr(host); err == nil {
		return nil
	}
	if strings.ContainsAny(host, "/?#@\\:%") {
		return errors.New("ssrf: invalid host")
	}
	return nil
}

// checkAddr returns an error if addr is in any blocked range.
//
// host is the original hostname (or IP literal) used for allowlist matching.
// At dial time host will itself be an IP literal; the allowlist check must
// therefore accept both the hostname form and the resolved IP string.
func checkAddr(addr netip.Addr, host, port string, cfg Config) error {
	// Strip any IPv6 zone identifier (e.g. fe80::1%eth0) before range checks:
	// netip.Prefix.Contains returns false for ANY zoned address, so without this

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Provide a valid host.

When it happens

Trigger: Thrown at shared/platform/ssrf/ssrf.go:244 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/2fb12bc1e1f9a51a. Report an issue: GitHub.