{"record":{"id":"2aa8af684b7476a3","repo":"apache/dubbo","slug":"if-you-config-ip-expression-that-contains-or","errorCode":null,"errorMessage":"If you config ip expression that contains '*' or '-', please fill qualified ip pattern like 234e:0:4567:0:0:0:3d:*. ","messagePattern":"If you config ip expression that contains '\\*' or '-', please fill qualified ip pattern like 234e:0:4567:0:0:0:3d:\\*\\. ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"dubbo-common/src/main/java/org/apache/dubbo/common/utils/NetUtils.java","lineNumber":865,"sourceCode":"        int i = host.indexOf('.');\n        if (i > 0) {\n            String prefix = host.substring(0, i);\n            if (StringUtils.isNumber(prefix)) {\n                int p = Integer.parseInt(prefix);\n                return p >= 224 && p <= 239;\n            }\n        }\n        return false;\n    }\n\n    private static boolean ipPatternContainExpression(String pattern) {\n        return pattern.contains(\"*\") || pattern.contains(\"-\");\n    }\n\n    private static void checkHostPattern(String pattern, String[] mask, boolean isIpv4) {\n        if (!isIpv4) {\n            if (mask.length != 8 && ipPatternContainExpression(pattern)) {\n                throw new IllegalArgumentException(\n                        \"If you config ip expression that contains '*' or '-', please fill qualified ip pattern like 234e:0:4567:0:0:0:3d:*. \");\n            }\n            if (mask.length != 8 && !pattern.contains(\"::\")) {\n                throw new IllegalArgumentException(\n                        \"The host is ipv6, but the pattern is not ipv6 pattern : \" + pattern);\n            }\n        } else {\n            if (mask.length != 4) {\n                throw new IllegalArgumentException(\n                        \"The host is ipv4, but the pattern is not ipv4 pattern : \" + pattern);\n            }\n        }\n    }\n\n    private static String[] getPatternHostAndPort(String pattern, boolean isIpv4) {\n        String[] result = new String[2];\n        if (pattern.startsWith(\"[\") && pattern.contains(\"]:\")) {\n            int end = pattern.indexOf(\"]:\");","sourceCodeStart":847,"sourceCodeEnd":883,"githubUrl":"https://github.com/apache/dubbo/blob/3a3043227f5571d25eb2889de5bca22f2914843b/dubbo-common/src/main/java/org/apache/dubbo/common/utils/NetUtils.java#L847-L883","documentation":"NetUtils.checkHostPattern enforces that IPv6 patterns containing wildcard '*' or range '-' must be fully qualified with exactly 8 segments (e.g. 234e:0:4567:0:0:0:3d:*). A short/abbreviated IPv6 pattern with expressions is ambiguous and rejected.","triggerScenarios":"Configuring an IPv6 IP rule with '*' or '-' but providing fewer than 8 colon-separated segments (no '::' expansion allowed when expressions are present).","commonSituations":"Writing a compact IPv6 rule like '234e::3d:*' that omits zero-groups while also using a wildcard; miscounting segments in an ACL rule.","solutions":["Expand the IPv6 pattern to all 8 segments, replacing elided groups with explicit 0, before adding '*' or '-'","If you need '::' abbreviation, do not combine it with '*' or '-' expressions","Validate that the pattern has 8 segments before applying it"],"exampleFix":"# before\nallow-ip: 234e::3d:*\n# after\nallow-ip: 234e:0:0:0:0:0:3d:*","handlingStrategy":"validation","validationCode":"String pattern = ...;\nString[] mask = pattern.split(\":\");\nboolean isIpv6 = !host.contains(\".\");\nif (isIpv6 && (pattern.contains(\"*\") || pattern.contains(\"-\")) && mask.length != 8) {\n    /* expand to full 8 segments before passing to NetUtils */\n}","typeGuard":"static boolean validIpv6ExpressionPattern(String p) {\n    if (!(p.contains(\"*\") || p.contains(\"-\"))) return true;\n    return p.split(\":\").length == 8;\n}","tryCatchPattern":"try { NetUtils.matchIpRange(pattern, host, port); }\ncatch (IllegalArgumentException e) { /* IPv6 pattern needed full 8 segments */ }","preventionTips":["Fully expand IPv6 patterns when using wildcards/ranges","Do not mix '::' abbreviation with '*' or '-' expressions"],"tags":["network","ipv6","config","validation"],"backgroundTag":null,"analyzedSha":"3a3043227f5571d25eb2889de5bca22f2914843b","analyzedAt":"2026-08-14T00:43:19.853Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}