apache/shenyu · error · IllegalArgumentException

Cannot resolve host: " + host

Error message

Cannot resolve host: " + host

What it means

validateHostForSSRF wraps InetAddress.getAllByName in a try/catch for UnknownHostException and rethrows it as IllegalArgumentException "Cannot resolve host: <host>". This means DNS lookup failed — the hostname does not exist, DNS is unreachable, or the name is malformed.

Solutions

1. Verify the hostname with `nslookup <host>` or `dig <host>` and fix typos.
2. Check DNS configuration on the host running shenyu-admin (/etc/resolv.conf, nameserver reachability).
3. Use an IP-based public hostname or ensure the domain's DNS records exist before registering the URL.

Example fix

// before
UrlSecurityUtils.validateUrlForSSRF("http://backen.example.com/api"); // typo
// after
UrlSecurityUtils.validateUrlForSSRF("http://backend.example.com/api");

// resolve before validating
InetAddress.getByName(host); // throws UnknownHostException early if unresolvable

boolean hostResolvable(String host) {
    try { InetAddress.getAllByName(host); return true; }
    catch (UnknownHostException e) { return false; }
}

try {
    UrlSecurityUtils.validateUrlForSSRF(url);
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Cannot resolve host")) {
        log.error("DNS failure for {}: check DNS config/hostname spelling", url);
    }
}

When it happens

Trigger: Calling validateUrlForSSRF with a hostname that has no DNS record, a typo'd domain, or while the JVM's DNS resolver cannot reach any nameserver.

Common situations: Misconfigured upstream URLs in plugin/divide configuration, offline or air-gapped environments, broken /etc/resolv.conf, or IPv6-only names when DNS lacks AAAA records.

Related errors

• Access to private or internal IP addresses is not allowed
• Resolved IP address is not allowed: " +…
• Import mcp server config failed:
• Failed to get Swagger document, HTTP status code:
• Access to sensitive ports is not allowed

AI-assisted analysis of apache/shenyu@567142e072 (2026-09-12). Data as JSON: /api/errors/c9b70a07ae69dd77. Report an issue: GitHub.

Appendix: source

Thrown at shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java:115

            throw new IllegalArgumentException("Access to sensitive ports is not allowed");
        }

        // Additional validation for DNS resolution
        try {
            InetAddress[] addresses = InetAddress.getAllByName(normalizedHost);
            for (InetAddress address : addresses) {
                if (address.isLoopbackAddress() || address.isLinkLocalAddress()
                        || address.isSiteLocalAddress() || address.isAnyLocalAddress()) {
                    throw new IllegalArgumentException("Resolved IP address is not allowed: " + address.getHostAddress());
                }

                // Check resolved IP against private ranges
                if (isPrivateIPAddress(address.getHostAddress())) {
                    throw new IllegalArgumentException("Resolved IP address is private: " + address.getHostAddress());
                }
            }
        } catch (UnknownHostException e) {
            throw new IllegalArgumentException("Cannot resolve host: " + host);
        }
    }

    /**
     * Check if the host is localhost or localhost variations.
     *
     * @param host the host to check
     * @return true if the host is localhost
     */
    private static boolean isLocalhost(final String host) {
        Set<String> localhostVariations = new HashSet<>(Arrays.asList(
                "localhost", "127.0.0.1", "::1", "0.0.0.0", "0000:0000:0000:0000:0000:0000:0000:0001"
        ));
        return localhostVariations.contains(host);
    }

    /**
     * Check if the host is a private or internal IP address.

View on GitHub (pinned to 567142e072)