{"record":{"id":"2b07d45579e24fb5","repo":"Tencent/WeKnora","slug":"connection-blocked-s-resolves-to-restricted-ip","errorCode":null,"errorMessage":"connection blocked: %s resolves to restricted IP %s","messagePattern":"connection blocked: (.+?) resolves to restricted IP (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/infrastructure/web_fetch/fetcher.go","lineNumber":242,"sourceCode":"func (f *Fetcher) pinnedDialContext() func(context.Context, string, string) (net.Conn, error) {\n\treturn func(ctx context.Context, network, address string) (net.Conn, error) {\n\t\thost, port, err := net.SplitHostPort(address)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid address %s: %w\", address, err)\n\t\t}\n\t\tif utils.IsSystemProxy(address) || utils.IsSSRFWhitelisted(host) {\n\t\t\treturn (&net.Dialer{Timeout: 30 * time.Second, KeepAlive: 30 * time.Second}).DialContext(ctx, network, address)\n\t\t}\n\t\tips, err := f.resolveIPs(ctx, host)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"DNS resolution failed for %s: %w\", host, err)\n\t\t}\n\t\tif len(ips) == 0 {\n\t\t\treturn nil, fmt.Errorf(\"DNS resolution failed: no addresses for %s\", host)\n\t\t}\n\t\tfor _, ip := range ips {\n\t\t\tif !utils.IsPublicIP(ip) {\n\t\t\t\treturn nil, fmt.Errorf(\"connection blocked: %s resolves to restricted IP %s\", host, ip)\n\t\t\t}\n\t\t}\n\t\tpinnedAddress := net.JoinHostPort(ips[0].String(), port)\n\t\tif f.dialContext != nil {\n\t\t\treturn f.dialContext(ctx, network, pinnedAddress)\n\t\t}\n\t\treturn (&net.Dialer{Timeout: 30 * time.Second, KeepAlive: 30 * time.Second}).DialContext(ctx, network, pinnedAddress)\n\t}\n}\n\nfunc (f *Fetcher) fetchWithBrowser(ctx context.Context, rawURL string) (string, error) {\n\ttarget, err := f.resolvePinnedTarget(ctx, rawURL)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\treturn f.renderBrowser(ctx, target)\n}\n","sourceCodeStart":224,"sourceCodeEnd":260,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/infrastructure/web_fetch/fetcher.go#L224-L260","documentation":"Fired in pinnedDialContext when a resolved IP of the target host falls in a restricted range (private, loopback, link-local, etc.). This is the SSRF guard: the fetcher deliberately blocks connections to internal network addresses reached via a public hostname (DNS rebinding protection).","triggerScenarios":"Thrown at internal/infrastructure/web_fetch/fetcher.go:242 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm the URL points to a genuinely public host","If the host is intentionally internal, add it to the SSRF whitelist rather than disabling the guard","Do not bypass this check for user-supplied URLs"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}