{"record":{"id":"13b828b753ad155a","repo":"iflytek/astron-agent","slug":"toolbox-url-illegal","errorCode":"TOOLBOX_URL_ILLEGAL","errorMessage":"TOOLBOX_URL_ILLEGAL","messagePattern":"TOOLBOX_URL_ILLEGAL","errorType":"error_code","errorClass":"BusinessException","httpStatus":null,"severity":"error","filePath":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java","lineNumber":72,"sourceCode":"\n    // Common short link domains\n    private static final Set<String> SHORT_LINK_DOMAINS = Set.of(\n            \"bit.ly\", \"tinyurl.com\", \"t.co\", \"rebrandly.com\", \"is.gd\", \"t.ly\",\n            \"monojson.com\", \"t.cn\", \"url.cn\", \"dwz.cn\");\n\n    /**\n     * Throws exception if URL host is IPv6 (current policy: disable IPv6). Silently returns on parsing\n     * exception (doesn't affect main flow).\n     *\n     * @param url the URL to check for IPv6\n     * @throws BusinessException if the URL host is IPv6 or malformed\n     */\n    public static void checkUrlForIPv6(String url) {\n        try {\n            URI uri = new URI(url);\n            String host = uri.getHost();\n            if (host == null) {\n                throw new BusinessException(ResponseEnum.TOOLBOX_URL_ILLEGAL);\n            }\n            InetAddress inet = InetAddress.getByName(host);\n            if (inet instanceof Inet6Address) {\n                log.info(\"URL host is IPv6: {}\", host);\n                throw new BusinessException(ResponseEnum.TOOLBOX_URL_ILLEGAL);\n            }\n        } catch (BusinessException e) {\n            throw e;\n        } catch (Exception ignore) {\n            // Parsing failure not handled here, let upper layer handle uniformly\n        }\n    }\n\n    /**\n     * Rejects IPv4-mapped IPv6 address format, such as: http://[::ffff:192.168.1.1]/path\n     *\n     * @param url the URL to check for IPv4-mapped IPv6 format\n     * @throws BusinessException if the URL contains IPv4-mapped IPv6 format","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java#L54-L90","documentation":"In UrlCheckTool.checkUrlForIPv6, TOOLBOX_URL_ILLEGAL is thrown when java.net.URI cannot extract a host from the URL (uri.getHost() == null). This happens for URLs with no authority component, malformed authority, or schemes URI cannot parse, meaning the URL is not a well-formed http(s) address.","triggerScenarios":"Calling checkUrl / checkUrlForIPv6 with a URL like \"http://\", a URL with no authority (e.g. \"file:/path\"), a malformed authority (e.g. \"http://exa mple.com\"), or any string that parses as a URI but yields no host.","commonSituations":"Users pasting truncated URLs into the toolbox, URLs containing spaces or unencoded special characters, empty host after protocol, or client-side transformations that strip the authority.","solutions":["Validate the URL on the client/entry point and require a full http(s) URL with a host before submitting.","Percent-encode spaces and special characters in the URL.","Check the input string for truncation or missing host and re-enter the complete URL.","Wrap calls in a pre-check that constructs new URI(url) and requires getHost() != null."],"exampleFix":"// before\nString url = \"http://\"; // no host\nurlCheckTool.checkUrl(url); // TOOLBOX_URL_ILLEGAL\n// after\nURI uri = new URI(\"http://example.com/path\");\nif (uri.getHost() != null) {\n    urlCheckTool.checkUrl(\"http://example.com/path\");\n}","handlingStrategy":"validation","validationCode":"static boolean hasParsableHost(String url) {\n    try {\n        return new URI(url).getHost() != null;\n    } catch (URISyntaxException e) {\n        return false;\n    }\n}\n// call only if hasParsableHost(url)","typeGuard":"null","tryCatchPattern":"try {\n    urlCheckTool.checkUrl(url);\n} catch (BusinessException e) {\n    if (\"TOOLBOX_URL_ILLEGAL\".equals(e.getCode())) {\n        // show \"URL is malformed or not allowed\" validation error\n    } else { throw e; }\n}","preventionTips":["Require full absolute http(s) URLs from user input.","Trim and percent-encode user-supplied URLs before submission.","Client-side validate with new URL(url) and check hostname is non-empty.","Reject inputs containing whitespace or unencoded specials early."],"tags":["url","validation","java","ssrf"],"backgroundTag":"invalid-url-format","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}