{"record":{"id":"2fb12bc1e1f9a51a","repo":"JuliusBrussee/caveman","slug":"ssrf-invalid-host","errorCode":null,"errorMessage":"ssrf: invalid host","messagePattern":"ssrf: invalid host","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/ssrf/ssrf.go","lineNumber":244,"sourceCode":"\tfor _, ia := range addrs {\n\t\ta, ok := netip.AddrFromSlice(ia.IP)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"ssrf: could not parse resolved IP %v for host %q\", ia.IP, host)\n\t\t}\n\t\ta = a.Unmap() // normalise ::ffff:x.x.x.x → x.x.x.x\n\t\tif err := checkAddr(a, host, port, cfg); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\n// validateHostInput rejects URL/userinfo-shaped values before they reach DNS\n// or an error formatter. IP literals (including zoned IPv6) are handled by\n// netip.ParseAddr and may contain colons or a zone identifier.\nfunc validateHostInput(host string) error {\n\tif host == \"\" {\n\t\treturn errors.New(\"ssrf: invalid host\")\n\t}\n\tif _, err := netip.ParseAddr(host); err == nil {\n\t\treturn nil\n\t}\n\tif strings.ContainsAny(host, \"/?#@\\\\:%\") {\n\t\treturn errors.New(\"ssrf: invalid host\")\n\t}\n\treturn nil\n}\n\n// checkAddr returns an error if addr is in any blocked range.\n//\n// host is the original hostname (or IP literal) used for allowlist matching.\n// At dial time host will itself be an IP literal; the allowlist check must\n// therefore accept both the hostname form and the resolved IP string.\nfunc checkAddr(addr netip.Addr, host, port string, cfg Config) error {\n\t// Strip any IPv6 zone identifier (e.g. fe80::1%eth0) before range checks:\n\t// netip.Prefix.Contains returns false for ANY zoned address, so without this","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/shared/platform/ssrf/ssrf.go#L226-L262","documentation":"Error \"ssrf: invalid host\" thrown in JuliusBrussee/caveman.","triggerScenarios":"Thrown at shared/platform/ssrf/ssrf.go:244 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide a valid host."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}