apache/shenyu · error · IllegalArgumentException

URL cannot be empty

Error message

URL cannot be empty

What it means

UrlSecurityUtils.validateUrlForSSRF performs SSRF (Server-Side Request Forgery) validation on URLs that shenyu-admin will request. If the URL string is null, empty, or whitespace-only it throws IllegalArgumentException "URL cannot empty" before any parsing occurs.

Solutions

1. Provide a complete URL (including scheme) in the configuration field or API call.
2. Validate/require the URL input at the form/config level before reaching the request pipeline.
3. Check upstream variable substitution — an unresolved placeholder may yield an empty string.
4. Catch IllegalArgumentException and return a clear 'target URL is required' validation message.

Example fix

// before
validateUrlForSSRF(config.getTargetUrl()); // may be null/empty
// after
if (config.getTargetUrl() == null || config.getTargetUrl().isBlank()) {
    throw new IllegalArgumentException("Target URL must be configured");
}
validateUrlForSSRF(config.getTargetUrl());

String url = config.getTargetUrl();
if (url == null || url.trim().isEmpty()) {
    throw new IllegalArgumentException("Target URL must be configured and non-empty");
}

boolean hasUrl(String s) { return s != null && !s.trim().isEmpty(); }

try {
    UrlSecurityUtils.validateUrlForSSRF(url);
} catch (IllegalArgumentException e) {
    return ResponseEntity.badRequest().body("Target URL is required");
}

When it happens

Trigger: Calling validateUrlForSSRF(null), validateUrlForSSRF(""), or a blank/whitespace string — typically when a URL config field was never filled in or the value was lost in upstream parsing.

Common situations: Health-check or webhook target URLs left blank in the admin dashboard; environment/config placeholders not substituted (e.g. '${TARGET_URL}' unresolved or empty); splitting logic producing an empty string.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• Invalid URL format
• Only HTTP and HTTPS protocols are allowed
• Host cannot be empty
• Access to localhost is not allowed
• Access to private or internal IP addresses is not allowed

AI-assisted analysis of apache/shenyu@567142e072 (2026-09-12). Data as JSON: /api/errors/09afc2070d332dde. Report an issue: GitHub.

Appendix: source

Thrown at shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java:52

    private static final String HTTP_PROTOCOL = "http";

    private static final String HTTPS_PROTOCOL = "https";

    /**
     * Private constructor to prevent instantiation.
     */
    private UrlSecurityUtils() {
    }

    /**
     * Validate URL to prevent SSRF attacks.
     *
     * @param url the URL to validate
     * @throws IllegalArgumentException if the URL is not safe for external requests
     */
    public static void validateUrlForSSRF(final String url) {
        if (Objects.isNull(url) || url.trim().isEmpty()) {
            throw new IllegalArgumentException("URL cannot be empty");
        }

        HttpUrl parsedUrl = HttpUrl.parse(url);
        if (Objects.isNull(parsedUrl)) {
            throw new IllegalArgumentException("Invalid URL format");
        }

        String protocol = parsedUrl.scheme();

        // Only allow HTTP and HTTPS protocols
        if (!HTTP_PROTOCOL.equals(protocol) && !HTTPS_PROTOCOL.equals(protocol)) {
            throw new IllegalArgumentException("Only HTTP and HTTPS protocols are allowed");
        }

        // Validate host for SSRF protection using the same URL parser as request execution.
        validateHostForSSRF(parsedUrl.host(), parsedUrl.port());
    }

View on GitHub (pinned to 567142e072)