{"record":{"id":"056d6ca12b4570d6","repo":"Tencent/WeKnora","slug":"wildcard-pattern-q-is-not-supported-only-the","errorCode":null,"errorMessage":"wildcard pattern %q is not supported (only the \"*.\" prefix is allowed)","messagePattern":"wildcard pattern %q is not supported \\(only the \"\\*\\.\" prefix is allowed\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":1041,"sourceCode":"\tfor _, entry := range entries {\n\t\tentry = strings.TrimSpace(entry)\n\t\tif entry == \"\" {\n\t\t\tcontinue\n\t\t}\n\t\tif strings.Contains(entry, \"/\") {\n\t\t\tif _, _, err := net.ParseCIDR(entry); err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid CIDR %q: %w\", entry, err)\n\t\t\t}\n\t\t\tcontinue\n\t\t}\n\t\tif strings.HasPrefix(entry, \"*.\") {\n\t\t\tif len(entry) <= 2 {\n\t\t\t\treturn fmt.Errorf(\"wildcard entry %q is missing a domain (use *.example.com)\", entry)\n\t\t\t}\n\t\t\tcontinue\n\t\t}\n\t\tif strings.Contains(entry, \"*\") {\n\t\t\treturn fmt.Errorf(\"wildcard pattern %q is not supported (only the \\\"*.\\\" prefix is allowed)\", entry)\n\t\t}\n\t}\n\treturn nil\n}\n\n// mergeSSRFWhitelistRaws joins two comma-separated raw strings, dropping\n// the comma when one side is empty. Exposed for the service layer's\n// \"merge SSRF_WHITELIST_EXTRA into the DB-backed list\" code path.\nfunc mergeSSRFWhitelistRaws(primary, extra string) string {\n\tprimary = strings.TrimSpace(primary)\n\textra = strings.TrimSpace(extra)\n\tswitch {\n\tcase primary == \"\" && extra == \"\":\n\t\treturn \"\"\n\tcase primary == \"\":\n\t\treturn extra\n\tcase extra == \"\":\n\t\treturn primary","sourceCodeStart":1023,"sourceCodeEnd":1059,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L1023-L1059","documentation":"ValidateSSRFWhitelistEntries only supports the leading '*.' wildcard form. Any other placement of '*' inside an entry (e.g. '*.example.*', 'api-*.example.com', '10.0.0.*') is rejected. This prevents overly broad or ambiguous matching patterns that the whitelist implementation does not implement.","triggerScenarios":"A whitelist entry contains '*' anywhere other than a leading '*.' prefix — e.g. 'sub.*.com', '*example.com', '10.0.0.*' as an IP wildcard, or an accidental shell glob pasted into config.","commonSituations":"Operators assuming glob or IP-octet wildcard support; copying shell patterns like '*.internal.*' into whitelist env vars; typos where a stray '*' lands mid-entry.","solutions":["Move the wildcard to the leading prefix only: '*.example.com'","Enumerate the specific hosts instead of using mid-string wildcards (e.g. 'api.example.com,cdn.example.com')","Use CIDR notation for IP ranges (10.0.0.0/24) rather than '10.0.0.*'","Remove any stray '*' characters from the entry"],"exampleFix":"// before\nSSRF_WHITELIST=10.0.0.*\n// after\nSSRF_WHITELIST=10.0.0.0/24","handlingStrategy":"validation","validationCode":"e := strings.TrimSpace(entry)\nif strings.Contains(e, \"*\") && !strings.HasPrefix(e, \"*.\") {\n    return fmt.Errorf(\"unsupported wildcard in %q\", e)\n}","typeGuard":"func isSupportedWildcardForm(entry string) bool {\n    return !strings.Contains(entry, \"*\") || strings.HasPrefix(entry, \"*.\")\n}","tryCatchPattern":null,"preventionTips":["Remember: only leading '*.domain' is supported — no mid-string or IP-octet wildcards","Use CIDR notation for IP ranges instead of 10.0.0.*","Enumerate explicit hostnames when a mid-string wildcard seems needed"],"tags":["ssrf","wildcard","configuration","validation"],"backgroundTag":"invalid-wildcard-pattern","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}