{"record":{"id":"26b40c78f7fcf618","repo":"apache/pulsar","slug":"invalid-ip-address-filter-ipaddressstring","errorCode":null,"errorMessage":"Invalid IP address filter '${ipAddressString}'","messagePattern":"Invalid IP address filter '(.+?)'","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/BrokerProxyValidator.java","lineNumber":74,"sourceCode":"            this.allowAnyHostName = true;\n            this.allowedHostNames = Collections.emptyList();\n        } else {\n            this.allowAnyHostName = false;\n            this.allowedHostNames = allowedHostNamesStrings.stream()\n                    .map(BrokerProxyValidator::parseWildcardPattern).collect(Collectors.toList());\n        }\n        List<String> allowedIPAddressesStrings = parseCommaSeparatedConfigValue(allowedIPAddresses);\n        if (allowedIPAddressesStrings.contains(ALLOW_ANY)) {\n            allowAnyIPAddress = true;\n            this.allowedIPAddresses = Collections.emptyList();\n        } else {\n            allowAnyIPAddress = false;\n            this.allowedIPAddresses = allowedIPAddressesStrings.stream().map(IPAddressString::new)\n                    .filter(ipAddressString -> {\n                        if (ipAddressString.isValid()) {\n                            return true;\n                        } else {\n                            throw new IllegalArgumentException(\"Invalid IP address filter '\" + ipAddressString + \"'\",\n                                    ipAddressString.getAddressStringException());\n                        }\n                    }).map(IPAddressString::getAddress)\n                    .filter(Objects::nonNull)\n                    .collect(Collectors.toList());\n        }\n        List<String> allowedTargetPortsStrings = parseCommaSeparatedConfigValue(allowedTargetPorts);\n        if (allowedTargetPortsStrings.contains(ALLOW_ANY)) {\n            allowAnyTargetPort = true;\n            this.allowedTargetPorts = new int[0];\n        } else {\n            allowAnyTargetPort = false;\n            this.allowedTargetPorts =\n                    allowedTargetPortsStrings.stream().mapToInt(Integer::parseInt).toArray();\n        }\n    }\n\n    private static Pattern parseWildcardPattern(String wildcardPattern) {","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/BrokerProxyValidator.java#L56-L92","documentation":"BrokerProxyValidator parses the proxy's allowed IP address filters into IPAddressString objects; any entry that is not a syntactically valid IP address or CIDR throws IllegalArgumentException immediately at validator construction. The message includes the offending filter string and the underlying address parse exception.","triggerScenarios":"Constructing BrokerProxyValidator with configuration containing an invalid entry in the IP allow list (e.g. proxyilaterally 'brokerProxyAllowedIPAddresses' style settings): typos, hostnames instead of IPs, malformed CIDR like '10.0.0.0/33'.","commonSituations":"Putting hostnames in an IP filter list; CIDR with an out-of-range prefix; stray whitespace or characters; IPv6 notation errors; copy-paste with comma/semicolon confusion.","solutions":["Fix the offending filter string shown in the message to a valid IP or CIDR (e.g. 10.0.0.0/24, 2001:db8::/32)","Remove any hostname entries — the filter accepts IP addresses/subnets, not DNS names","Validate each entry with an IP/CIDR calculator before adding it to the config","Restart the proxy and confirm the validator initializes without error"],"exampleFix":"// before\nbrokerProxyAllowedIPAddresses=10.0.0.0/24,mybroker.example.com\n// after\nbrokerProxyAllowedIPAddresses=10.0.0.0/24,192.168.1.5","handlingStrategy":"validation","validationCode":"// Validate every filter entry before writing proxy config\nfor (String s : allowedIpStrings.split(\",\")) {\n    IPAddressString ips = new IPAddressString(s.trim());\n    if (!ips.isValid()) throw new IllegalArgumentException(\"Bad IP filter: \" + s + \" -> \" + ips.getAddressStringException());\n}","typeGuard":"boolean isValidIpFilter(String s) {\n    IPAddressString ips = new IPAddressString(s.trim());\n    return ips.isValid() && ips.getAddress() != null;\n}","tryCatchPattern":"try { new BrokerProxyValidator(conf); } catch (IllegalArgumentException e) { log.error(\"Fix IP filter config: {}\", e.getMessage()); throw e; }","preventionTips":["Only use IP addresses/CIDR in allow lists, never hostnames","Lint IP/CIDR entries in CI with a library like IPAddress before deploy"],"tags":["configuration","ip-address","validation","pulsar-proxy"],"backgroundTag":"invalid-ip-address-filter","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}