Tencent/WeKnora · error

wildcard pattern %q is not supported (only the "*." prefix i

Error message

wildcard pattern %q is not supported (only the "*." prefix is allowed)

What it means

ValidateSSRFWhitelistEntries only supports the leading '*.' wildcard form. Any other placement of '*' inside an entry (e.g. '*.example.*', 'api-*.example.com', '10.0.0.*') is rejected. This prevents overly broad or ambiguous matching patterns that the whitelist implementation does not implement.

Source

Thrown at internal/utils/security.go:1041

	for _, entry := range entries {
		entry = strings.TrimSpace(entry)
		if entry == "" {
			continue
		}
		if strings.Contains(entry, "/") {
			if _, _, err := net.ParseCIDR(entry); err != nil {
				return fmt.Errorf("invalid CIDR %q: %w", entry, err)
			}
			continue
		}
		if strings.HasPrefix(entry, "*.") {
			if len(entry) <= 2 {
				return fmt.Errorf("wildcard entry %q is missing a domain (use *.example.com)", entry)
			}
			continue
		}
		if strings.Contains(entry, "*") {
			return fmt.Errorf("wildcard pattern %q is not supported (only the \"*.\" prefix is allowed)", entry)
		}
	}
	return nil
}

// mergeSSRFWhitelistRaws joins two comma-separated raw strings, dropping
// the comma when one side is empty. Exposed for the service layer's
// "merge SSRF_WHITELIST_EXTRA into the DB-backed list" code path.
func mergeSSRFWhitelistRaws(primary, extra string) string {
	primary = strings.TrimSpace(primary)
	extra = strings.TrimSpace(extra)
	switch {
	case primary == "" && extra == "":
		return ""
	case primary == "":
		return extra
	case extra == "":
		return primary

View on GitHub (pinned to 988cbb0330)

Solutions

1. Move the wildcard to the leading prefix only: '*.example.com'
2. Enumerate the specific hosts instead of using mid-string wildcards (e.g. 'api.example.com,cdn.example.com')
3. Use CIDR notation for IP ranges (10.0.0.0/24) rather than '10.0.0.*'
4. Remove any stray '*' characters from the entry

Example fix

// before
SSRF_WHITELIST=10.0.0.*
// after
SSRF_WHITELIST=10.0.0.0/24

e := strings.TrimSpace(entry)
if strings.Contains(e, "*") && !strings.HasPrefix(e, "*.") {
    return fmt.Errorf("unsupported wildcard in %q", e)
}

func isSupportedWildcardForm(entry string) bool {
    return !strings.Contains(entry, "*") || strings.HasPrefix(entry, "*.")
}

When it happens

Trigger: A whitelist entry contains '*' anywhere other than a leading '*.' prefix — e.g. 'sub.*.com', '*example.com', '10.0.0.*' as an IP wildcard, or an accidental shell glob pasted into config.

Common situations: Operators assuming glob or IP-octet wildcard support; copying shell patterns like '*.internal.*' into whitelist env vars; typos where a stray '*' lands mid-entry.

Related errors

• wildcard entry %q is missing a domain (use *.example.com)
• MinerU URL blocked by SSRF check: %v
• invalid CIDR %q: %w
• invalid sandbox type
• timeout cannot be negative

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/056d6ca12b4570d6. Report an issue: GitHub.