{"record":{"id":"259e2123b80a82d4","repo":"iflytek/astron-agent","slug":"toolbox-ip-in-blacklist","errorCode":"TOOLBOX_IP_IN_BLACKLIST","errorMessage":"TOOLBOX_IP_IN_BLACKLIST","messagePattern":"TOOLBOX_IP_IN_BLACKLIST","errorType":"error_code","errorClass":"BusinessException","httpStatus":null,"severity":"warning","filePath":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java","lineNumber":194,"sourceCode":"            throw new BusinessException(ResponseEnum.TOOLBOX_URL_ILLEGAL);\n        }\n        for (InetAddress inet : addresses) {\n            if (SsrfValidators.isIpLiteral(asciiHost)\n                    && SsrfValidators.isAddressMatchedByIpRules(inet, ipWhiteList)) {\n                log.debug(\"URL destination allowed by IP whitelist, host={}, ip={}\", asciiHost, inet.getHostAddress());\n                continue;\n            }\n            if (SsrfValidators.isRestrictedAddress(inet)) {\n                throw new BusinessException(ResponseEnum.TOOLBOX_URL_ILLEGAL);\n            }\n            if (domainWhitelisted) {\n                continue;\n            }\n            String ip = inet.getHostAddress();\n\n            // IPv4 blacklist\n            if (ipBlackList.stream().map(String::trim).anyMatch(ip::equals)) {\n                throw new BusinessException(ResponseEnum.TOOLBOX_IP_IN_BLACKLIST);\n            }\n\n            // Network segment blacklist (only effective for IPv4; IPv6 can be extended)\n            if (inet instanceof Inet4Address) {\n                for (String segment : segmentBlackList) {\n                    if (isIpInRange(ip, segment)) {\n                        throw new BusinessException(ResponseEnum.TOOLBOX_IP_IN_BLACKLIST);\n                    }\n                }\n            }\n        }\n    }\n\n    /**\n     * Determines if IPv4 falls within CIDR range (like 10.0.0.0/8). Returns false directly for invalid\n     * segments or IPv6 scenarios.\n     *\n     * @param ip the IP address to check","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java#L176-L212","documentation":"TOOLBOX_IP_IN_BLACKLIST is thrown when a resolved IP of the URL's host exactly matches an entry in the configured IP blacklist (IP_BLACK_LIST category from the ConfigInfo table). Comparison is exact string equality on the resolved address after trimming blacklist entries.","triggerScenarios":"Calling checkUrl/checkBlackList where any address returned by InetAddress.getAllByName(host) equals (as a string) one of the comma-separated entries in the IP_BLACK_LIST config row.","commonSituations":"The target domain's IP was added to the deny list by an administrator, the domain recently moved to a blacklisted IP (hosting provider blocklist), or an overly broad blacklist entry that also covers the legitimate target's current address.","solutions":["Check the IP_BLACK_LIST configuration (ConfigInfo table) and confirm whether the resolved IP should really be denied.","If the block is wrong/outdated, update the blacklist to remove or correct the entry.","Resolve the target domain and compare with the blacklist; switch to a host not resolving to a blacklisted IP.","For domain-based access, prefer whitelisting the domain (DOMAIN_WHITE_LIST) so IP changes don't break it — but note the built-in restricted-address policy still applies."],"exampleFix":"// before: target resolves to 203.0.113.7 which is in IP_BLACK_LIST\nurlCheckTool.checkUrl(\"http://blocked-target.example/\"); // TOOLBOX_IP_IN_BLACKLIST\n// after: admin fixes the stale blacklist entry in ConfigInfo (IP_BLACK_LIST)\n// value: \"203.0.113.7,198.51.100.9\" -> \"198.51.100.9\"\nurlCheckTool.checkUrl(\"http://blocked-target.example/\"); // passes","handlingStrategy":"validation","validationCode":"static boolean ipBlacklisted(String url, java.util.List<String> ipBlackList) {\n    try {\n        String host = new URI(url).getHost();\n        if (host == null) return false;\n        for (InetAddress a : InetAddress.getAllByName(host)) {\n            String ip = a.getHostAddress();\n            if (ipBlackList.stream().map(String::trim).anyMatch(ip::equals)) return true;\n        }\n        return false;\n    } catch (Exception e) { return false; }\n}","typeGuard":"null","tryCatchPattern":"try {\n    urlCheckTool.checkUrl(url);\n} catch (BusinessException e) {\n    if (\"TOOLBOX_IP_IN_BLACKLIST\".equals(e.getCode())) {\n        // inform user the destination IP is deny-listed; escalate to admin if legitimate\n    } else { throw e; }\n}","preventionTips":["Keep the IP_BLACK_LIST config reviewed and current.","Resolve target domains and diff against the blacklist before deployments.","Prefer domain whitelisting for stable partners to survive IP changes.","Audit blacklist changes with an owner and reason."],"tags":["security","blacklist","url","configuration"],"backgroundTag":"invalid-url","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}