{"record":{"id":"2600f0f19787391d","repo":"honojs/hono","slug":"invalid-rule-rule","errorCode":null,"errorMessage":"Invalid rule: ${rule}","messagePattern":"Invalid rule: (.+?)","errorType":"validation","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/middleware/ip-restriction/index.ts","lineNumber":43,"sourceCode":"/**\n * ### IPv4 and IPv6\n * - `*` match all\n *\n * ### IPv4\n * - `192.168.2.0` static\n * - `192.168.2.0/24` CIDR Notation\n *\n * ### IPv6\n * - `::1` static\n * - `::1/10` CIDR Notation\n */\ntype IPRestrictionRuleFunction = (addr: { addr: string; type: AddressType }) => boolean\nexport type IPRestrictionRule = string | ((addr: { addr: string; type: AddressType }) => boolean)\n\nconst IS_CIDR_NOTATION_REGEX = /\\/[^/]*$/\nconst parseCidrPrefix = (rule: string, prefix: string, max: number): number => {\n  if (!/^[0-9]{1,3}$/.test(prefix)) {\n    throw new TypeError(`Invalid rule: ${rule}`)\n  }\n  const parsedPrefix = parseInt(prefix)\n  if (parsedPrefix > max) {\n    throw new TypeError(`Invalid rule: ${rule}`)\n  }\n  return parsedPrefix\n}\nconst buildMatcher = (\n  rules: IPRestrictionRule[]\n): ((addr: { addr: string; type: AddressType; isIPv4: boolean }) => boolean) => {\n  const functionRules: IPRestrictionRuleFunction[] = []\n  const staticRules: Set<string> = new Set()\n  const staticIPv4Rules: Set<bigint> = new Set()\n  const staticIPv6Rules: Set<bigint> = new Set()\n  const cidrRules: [boolean, bigint, bigint][] = []\n  const registerStaticRule = (rule: string): void => {\n    const type = distinctRemoteAddr(rule)\n    if (type === undefined) {","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/honojs/hono/blob/e2740d5a1bd0b4254e517e3af8b60789284bc7bd/src/middleware/ip-restriction/index.ts#L25-L61","documentation":"This TypeError is thrown by the ip-restriction middleware's CIDR parsing when a rule string's prefix (the part after '/') is not 1-3 digits or exceeds the maximum prefix length for the address family (32 for IPv4, 128 for IPv6). Rules are parsed eagerly when the middleware is created, so bad rules fail fast with 'Invalid rule: <rule>'.","triggerScenarios":"Passing rules like '10.0.0.0/8x' (non-numeric prefix), '10.0.0.0/' or '10.0.0.0/abc' (fails the digits regex), '10.0.0.0/33' (>32 for IPv4), '::1/129' (>128 for IPv6); building rules from user input or env vars without validation; joining rules with extra slashes.","commonSituations":"Env-configured allowlists with typos, generating CIDR ranges programmatically and emitting an empty or invalid prefix, confusing subnet mask notation (255.255.0.0) with CIDR prefix length (/16), or IPv6 rules written with an embedded '/' mistake.","solutions":["Correct the rule to valid CIDR: digits only after the slash, within 0-32 (IPv4) or 0-128 (IPv6)","If rules come from config/env, validate them at startup (regex + range check) before creating the middleware","Use the function form of a rule — (addr) => boolean — for non-CIDR logic instead of malformed strings","Test rule lists in CI so a typo fails the build, not deployment"],"exampleFix":"// before\nconst restriction = ipRestriction(['10.0.0.0/8x', '192.168.1.0/24'])\n\n// after\nconst restriction = ipRestriction(['10.0.0.0/8', '192.168.1.0/24'])","handlingStrategy":"validation","validationCode":"const isValidCidrRule = (rule: string): boolean => {\n  const m = rule.match(/^(\\d{1,3}(?:\\.\\d{1,3}){3}|[0-9a-fA-F:]+)\\/(\\d{1,3})$/)\n  if (!m) return false\n  const max = rule.includes(':') ? 128 : 32\n  return Number(m[2]) <= max\n}\n\nconst rules = (process.env.ALLOWED_CIDRS ?? '').split(',').map((s) => s.trim()).filter(Boolean)\nif (!rules.every(isValidCidrRule)) throw new Error('Invalid CIDR in ALLOWED_CIDRS')\nconst mw = ipRestriction(rules)","typeGuard":"const isCidrRule = (r: string): boolean => {\n  const idx = r.lastIndexOf('/')\n  if (idx === -1) return true // plain IP\n  const prefix = r.slice(idx + 1)\n  const max = r.includes(':') ? 128 : 32\n  return /^[0-9]{1,3}$/.test(prefix) && parseInt(prefix) <= max\n}","tryCatchPattern":"null","preventionTips":["Treat allowlists as validated config: parse and check CIDR rules at startup","Write CIDR prefixes as /N, never as subnet masks","Add CI validation for env-provided IP rules","Prefer the function rule form for anything programmatic"],"tags":["ip-restriction","cidr","validation","configuration","middleware"],"backgroundTag":"invalid-cidr-notation","analyzedSha":"e2740d5a1bd0b4254e517e3af8b60789284bc7bd","analyzedAt":"2026-08-28T10:18:08.750Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}