JuliusBrussee/caveman · error

ssrf: invalid URL

Error message

ssrf: invalid URL

What it means

Error "ssrf: invalid URL" thrown in JuliusBrussee/caveman.

Source

Thrown at shared/platform/ssrf/ssrf.go:164

// SelfHostedConfig returns a Config with ManagedMode disabled and the given
// allowlist.
func SelfHostedConfig(allowList ...string) Config {
	return Config{ManagedMode: false, AllowList: allowList}
}

// ValidateURL resolves raw to a URL, validates the scheme/port constraints,
// and checks every IP the hostname resolves to against the SSRF block lists.
// It is a pre-flight check only — see NewDialContext for dial-time enforcement.
//
// Errors are safe to return to callers; they contain the blocked IP but never
// the original credential material.
func ValidateURL(ctx context.Context, raw string, cfg Config) error {
	u, err := url.Parse(raw)
	if err != nil {
		// net/url.Error includes the raw URL (and may therefore include
		// credentials or query secrets). Keep this error field-only and stable.
		return errors.New("ssrf: invalid URL")
	}
	if u.Scheme != "https" && !(u.Scheme == "http" && !cfg.ManagedMode) {
		return fmt.Errorf("ssrf: scheme %q not permitted (managed mode requires https)", u.Scheme)
	}
	if u.User != nil {
		return fmt.Errorf("ssrf: credentials embedded in URL are forbidden")
	}
	host := u.Hostname()
	if host == "" {
		return fmt.Errorf("ssrf: URL must contain a host")
	}
	port := u.Port()
	if cfg.ManagedMode && port != "" && port != "443" {
		return errors.New("ssrf: managed mode requires port 443")
	}
	if port == "" {
		if u.Scheme == "https" {
			port = "443"

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Provide a valid URL.

When it happens

Trigger: Thrown at shared/platform/ssrf/ssrf.go:164 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/58ab6681c8c9465a. Report an issue: GitHub.