Tencent/WeKnora · error

unsafe OBS endpoint: %w

Error message

unsafe OBS endpoint: %w

What it means

OBS constructor SSRF guard: the configured endpoint URL failed ValidateURLForSSRF, meaning it targets a forbidden host (localhost, link-local, private/reserved ranges, or a disallowed scheme), so the client refuses to initialize to prevent server-side request forgery via storage config.

Source

Thrown at internal/application/service/file/obs.go:48

type obsEndpointResolver struct {
	url string
}

func (r *obsEndpointResolver) ResolveEndpoint(region string, options s3.EndpointResolverOptions) (aws.Endpoint, error) {
	return aws.Endpoint{
		URL:               r.url,
		SigningRegion:     region,
		HostnameImmutable: true,
	}, nil
}

func NewObsFileService(
	endpoint, region, accessKeyID, secretAccessKey, bucketName string,
	pathPrefix string,
) (interfaces.FileService, error) {
	if err := utils.ValidateURLForSSRF(endpoint); err != nil {
		return nil, fmt.Errorf("unsafe OBS endpoint: %w", err)
	}

	client := s3.New(s3.Options{
		Region:           region,
		EndpointResolver: &obsEndpointResolver{url: endpoint},
		Credentials:      credentials.NewStaticCredentialsProvider(accessKeyID, secretAccessKey, ""),
		UsePathStyle:     true,
		HTTPClient:       utils.NewSSRFSafeHTTPClient(utils.DefaultSSRFSafeHTTPClientConfig()),
	})

	_, err := client.HeadBucket(context.Background(), &s3.HeadBucketInput{
		Bucket: aws.String(bucketName),
	})
	if err != nil {
		_, createErr := client.CreateBucket(context.Background(), &s3.CreateBucketInput{
			Bucket: aws.String(bucketName),
		})
		if createErr != nil {

View on GitHub (pinned to 988cbb0330)

Solutions

1. Point the OBS endpoint at a legitimate public service endpoint
2. Allowlist the intended endpoint in SSRF validation config
3. Reject storage configs with internal addresses at save time

When it happens

Trigger: Thrown at internal/application/service/file/obs.go:48 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/fc1a50d61acee3d7. Report an issue: GitHub.