{"record":{"id":"28287a16f5c1d2e3","repo":"Tencent/WeKnora","slug":"invalid-cidr-q-w","errorCode":null,"errorMessage":"invalid CIDR %q: %w","messagePattern":"invalid CIDR %q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":1030,"sourceCode":"// the first malformed entry. Used by the system_settings Update path\n// to give the UI a clear 400 instead of silently dropping bad input\n// at parse-time.\n//\n// Validation rules mirror parseSSRFWhitelistRaw exactly:\n//   - \"<a>/<b>\" must be a valid CIDR\n//   - \"*.<domain>\" must have a non-empty domain after the prefix\n//   - mid-string \"*\" is not supported\n//   - everything else is treated as an exact host or literal IP\n//     (we don't pre-resolve DNS here; that's a runtime concern)\nfunc ValidateSSRFWhitelistEntries(entries []string) error {\n\tfor _, entry := range entries {\n\t\tentry = strings.TrimSpace(entry)\n\t\tif entry == \"\" {\n\t\t\tcontinue\n\t\t}\n\t\tif strings.Contains(entry, \"/\") {\n\t\t\tif _, _, err := net.ParseCIDR(entry); err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid CIDR %q: %w\", entry, err)\n\t\t\t}\n\t\t\tcontinue\n\t\t}\n\t\tif strings.HasPrefix(entry, \"*.\") {\n\t\t\tif len(entry) <= 2 {\n\t\t\t\treturn fmt.Errorf(\"wildcard entry %q is missing a domain (use *.example.com)\", entry)\n\t\t\t}\n\t\t\tcontinue\n\t\t}\n\t\tif strings.Contains(entry, \"*\") {\n\t\t\treturn fmt.Errorf(\"wildcard pattern %q is not supported (only the \\\"*.\\\" prefix is allowed)\", entry)\n\t\t}\n\t}\n\treturn nil\n}\n\n// mergeSSRFWhitelistRaws joins two comma-separated raw strings, dropping\n// the comma when one side is empty. Exposed for the service layer's","sourceCodeStart":1012,"sourceCodeEnd":1048,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L1012-L1048","documentation":"ValidateSSRFWhitelistEntries checks each comma-separated SSRF whitelist entry and rejects malformed CIDR notation. If an entry contains '/' it must be a valid network range parseable by net.ParseCIDR (e.g. 10.0.0.0/8). The error wraps the underlying parse error so the developer sees exactly which character broke the CIDR.","triggerScenarios":"A whitelist entry passed to ValidateSSRFWhitelistEntries (via validateRegistryEntry) contains '/' but is not valid CIDR — e.g. '10.0.0.1/' , '/24' (missing IP), '10.0.0.0/33' (bad prefix length), or '10.0.0.0/8/extra'.","commonSituations":"Hand-edited config files or env vars for SSRF whitelists where an operator typed a bare IP with a slash, copied an iptables-style range like 10.0.0.0-10.0.0.255, or specified a /33+/ mask. Also occurs when joining ranges from a spreadsheet or legacy firewall format.","solutions":["Fix the whitelist entry to valid CIDR: ensure form <ip>/<prefix-length>, e.g. 10.0.0.0/8 or 192.168.1.0/24","If you meant a single host, remove the '/' and use the bare IP or hostname (e.g. 10.0.0.5 not 10.0.0.5/32 if the parser chokes on stray whitespace)","Run net.ParseCIDR on all entries locally (or `ipcalc`) before deploying the config","Trim whitespace and hidden characters (full-width slash, non-breaking spaces) from the entry"],"exampleFix":"// before\nSSRF_WHITELIST=10.0.0.0-10.0.0.255,192.168.1.1/\n// after\nSSRF_WHITELIST=10.0.0.0/24,192.168.1.1/32","handlingStrategy":"validation","validationCode":"for _, e := range strings.Split(raw, \",\") {\n    e = strings.TrimSpace(e)\n    if strings.Contains(e, \"/\") {\n        if _, _, err := net.ParseCIDR(e); err != nil {\n            return fmt.Errorf(\"bad whitelist CIDR %q: %w\", e, err)\n        }\n    }\n}","typeGuard":"func isCIDRLike(entry string) bool {\n    return strings.Contains(entry, \"/\") && net.ParseCIDR(strings.TrimSpace(entry)) != nil\n}","tryCatchPattern":null,"preventionTips":["Validate whitelist env vars at startup, not per-request","Use ipcalc or net.ParseCIDR in a unit test over your production config","Prefer bare IPs/hostnames for single hosts and /N only for genuine ranges"],"tags":["ssrf","cidr","configuration","validation"],"backgroundTag":"invalid-cidr-notation","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}