Tencent/WeKnora · error

invalid CIDR %q: %w

Error message

invalid CIDR %q: %w

What it means

ValidateSSRFWhitelistEntries checks each comma-separated SSRF whitelist entry and rejects malformed CIDR notation. If an entry contains '/' it must be a valid network range parseable by net.ParseCIDR (e.g. 10.0.0.0/8). The error wraps the underlying parse error so the developer sees exactly which character broke the CIDR.

Source

Thrown at internal/utils/security.go:1030

// the first malformed entry. Used by the system_settings Update path
// to give the UI a clear 400 instead of silently dropping bad input
// at parse-time.
//
// Validation rules mirror parseSSRFWhitelistRaw exactly:
//   - "<a>/<b>" must be a valid CIDR
//   - "*.<domain>" must have a non-empty domain after the prefix
//   - mid-string "*" is not supported
//   - everything else is treated as an exact host or literal IP
//     (we don't pre-resolve DNS here; that's a runtime concern)
func ValidateSSRFWhitelistEntries(entries []string) error {
	for _, entry := range entries {
		entry = strings.TrimSpace(entry)
		if entry == "" {
			continue
		}
		if strings.Contains(entry, "/") {
			if _, _, err := net.ParseCIDR(entry); err != nil {
				return fmt.Errorf("invalid CIDR %q: %w", entry, err)
			}
			continue
		}
		if strings.HasPrefix(entry, "*.") {
			if len(entry) <= 2 {
				return fmt.Errorf("wildcard entry %q is missing a domain (use *.example.com)", entry)
			}
			continue
		}
		if strings.Contains(entry, "*") {
			return fmt.Errorf("wildcard pattern %q is not supported (only the \"*.\" prefix is allowed)", entry)
		}
	}
	return nil
}

// mergeSSRFWhitelistRaws joins two comma-separated raw strings, dropping
// the comma when one side is empty. Exposed for the service layer's

View on GitHub (pinned to 988cbb0330)

Solutions

1. Fix the whitelist entry to valid CIDR: ensure form <ip>/<prefix-length>, e.g. 10.0.0.0/8 or 192.168.1.0/24
2. If you meant a single host, remove the '/' and use the bare IP or hostname (e.g. 10.0.0.5 not 10.0.0.5/32 if the parser chokes on stray whitespace)
3. Run net.ParseCIDR on all entries locally (or `ipcalc`) before deploying the config
4. Trim whitespace and hidden characters (full-width slash, non-breaking spaces) from the entry

Example fix

// before
SSRF_WHITELIST=10.0.0.0-10.0.0.255,192.168.1.1/
// after
SSRF_WHITELIST=10.0.0.0/24,192.168.1.1/32

for _, e := range strings.Split(raw, ",") {
    e = strings.TrimSpace(e)
    if strings.Contains(e, "/") {
        if _, _, err := net.ParseCIDR(e); err != nil {
            return fmt.Errorf("bad whitelist CIDR %q: %w", e, err)
        }
    }
}

func isCIDRLike(entry string) bool {
    return strings.Contains(entry, "/") && net.ParseCIDR(strings.TrimSpace(entry)) != nil
}

When it happens

Trigger: A whitelist entry passed to ValidateSSRFWhitelistEntries (via validateRegistryEntry) contains '/' but is not valid CIDR — e.g. '10.0.0.1/' , '/24' (missing IP), '10.0.0.0/33' (bad prefix length), or '10.0.0.0/8/extra'.

Common situations: Hand-edited config files or env vars for SSRF whitelists where an operator typed a bare IP with a slash, copied an iptables-style range like 10.0.0.0-10.0.0.255, or specified a /33+/ mask. Also occurs when joining ranges from a spreadsheet or legacy firewall format.

Related errors

• MinerU URL blocked by SSRF check: %v
• wildcard entry %q is missing a domain (use *.example.com)
• wildcard pattern %q is not supported (only the "*." prefix i
• invalid sandbox type
• timeout cannot be negative

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/28287a16f5c1d2e3. Report an issue: GitHub.