Tencent/WeKnora · error

wildcard entry %q is missing a domain (use *.example.com)

Error message

wildcard entry %q is missing a domain (use *.example.com)

What it means

ValidateSSRFWhitelistEntries requires wildcard entries to take the form '*.domain'. An entry starting with '*.' but with no actual domain after it (total length <= 2, i.e. exactly '*' or '*.') is rejected because it would match nothing or everything ambiguously. This is a config-shape guard, not a runtime network failure.

Source

Thrown at internal/utils/security.go:1036

//   - "*.<domain>" must have a non-empty domain after the prefix
//   - mid-string "*" is not supported
//   - everything else is treated as an exact host or literal IP
//     (we don't pre-resolve DNS here; that's a runtime concern)
func ValidateSSRFWhitelistEntries(entries []string) error {
	for _, entry := range entries {
		entry = strings.TrimSpace(entry)
		if entry == "" {
			continue
		}
		if strings.Contains(entry, "/") {
			if _, _, err := net.ParseCIDR(entry); err != nil {
				return fmt.Errorf("invalid CIDR %q: %w", entry, err)
			}
			continue
		}
		if strings.HasPrefix(entry, "*.") {
			if len(entry) <= 2 {
				return fmt.Errorf("wildcard entry %q is missing a domain (use *.example.com)", entry)
			}
			continue
		}
		if strings.Contains(entry, "*") {
			return fmt.Errorf("wildcard pattern %q is not supported (only the \"*.\" prefix is allowed)", entry)
		}
	}
	return nil
}

// mergeSSRFWhitelistRaws joins two comma-separated raw strings, dropping
// the comma when one side is empty. Exposed for the service layer's
// "merge SSRF_WHITELIST_EXTRA into the DB-backed list" code path.
func mergeSSRFWhitelistRaws(primary, extra string) string {
	primary = strings.TrimSpace(primary)
	extra = strings.TrimSpace(extra)
	switch {
	case primary == "" && extra == "":

View on GitHub (pinned to 988cbb0330)

Solutions

1. Complete the wildcard entry with a real domain: '*.example.com' instead of '*.'
2. If a catch-all was intended, list explicit domains/CIDRs instead — the parser deliberately forbids bare '*'
3. Check that the env var/config substitution feeding the whitelist actually resolves (e.g. ${DOMAIN} is set)
4. Trim stray whitespace before the entry so it is not mangled during splitting

Example fix

// before
SSRF_WHITELIST=*.
// after
SSRF_WHITELIST=*.example.com

e := strings.TrimSpace(entry)
if strings.HasPrefix(e, "*.") && len(e) <= 2 {
    return fmt.Errorf("wildcard %q missing domain", e)
}

func isValidWildcard(entry string) bool {
    return strings.HasPrefix(entry, "*.") && len(entry) > len("*.x")
}

When it happens

Trigger: A whitelist entry is exactly '*' or '*.' — e.g. someone wrote '*.' intending 'allow all subdomains' but forgot the domain, or a template variable like '*.${DOMAIN}' expanded empty.

Common situations: Env-var templating where the domain variable is unset, copy-paste truncation of '*.example.com', or an operator attempting a catch-all wildcard by entering '*' alone.

Related errors

• wildcard pattern %q is not supported (only the "*." prefix i
• MinerU URL blocked by SSRF check: %v
• invalid CIDR %q: %w
• invalid sandbox type
• timeout cannot be negative

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/ac0b54fddc351c81. Report an issue: GitHub.