{"record":{"id":"3737f109dc1a55ee","repo":"larksuite/cli","slug":"invalid-proxy-address-q-host-and-port-must-not-b","errorCode":null,"errorMessage":"invalid proxy address %q: host and port must not be empty","messagePattern":"invalid proxy address %q: host and port must not be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sidecar/protocol.go","lineNumber":150,"sourceCode":"//\n// userinfo (user:pass@) is rejected unconditionally — the sidecar protocol\n// does not use basic auth, and the syntactic slot exists only as a phishing\n// vector (e.g. http://127.0.0.1@attacker.com).\n//\n// Returns an error if the value is not a valid proxy address.\nfunc ValidateProxyAddr(addr string) error {\n\tif addr == \"\" {\n\t\treturn fmt.Errorf(\"proxy address is empty\")\n\t}\n\n\t// Bare host:port (no scheme) — validate as a net address.\n\tif !strings.Contains(addr, \"://\") {\n\t\thost, port, err := net.SplitHostPort(addr)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid proxy address %q: expected host:port or http://host:port\", addr)\n\t\t}\n\t\tif host == \"\" || port == \"\" {\n\t\t\treturn fmt.Errorf(\"invalid proxy address %q: host and port must not be empty\", addr)\n\t\t}\n\t\tif !isSameHost(host) {\n\t\t\treturn errNotSameHost(addr)\n\t\t}\n\t\treturn nil\n\t}\n\n\tu, err := url.Parse(addr)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: %w\", addr, err)\n\t}\n\tif u.User != nil {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: userinfo is not allowed\", addr)\n\t}\n\tif u.Scheme == \"https\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: use http:// — sidecar is \"+\n\t\t\t\"same-host only (loopback or virtual same-host bridge), so TLS adds \"+\n\t\t\t\"no security; cross-machine deployment is out of scope\", addr)","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/sidecar/protocol.go#L132-L168","documentation":"For a bare (scheme-less) LARKSUITE_CLI_AUTH_PROXY value that SplitHostPort accepts, ValidateProxyAddr additionally requires both host and port to be non-empty. This error fires when one side is empty — e.g. \":16384\" (host omitted) or \"127.0.0.1:\" (port omitted).","triggerScenarios":"ValidateProxyAddr is called (via ResolveAccount / ResolveInterceptor / init) with a scheme-less value like \":16384\" or \"127.0.0.1:\", or with \":\" where the empty component follows from a truncated variable value.","commonSituations":"Variable partially truncated by shell quoting or a truncated secret; writing the listen address (\":16384\" — valid for net.Listen) where a dial address is required; typo dropping the host or port.","solutions":["Specify both host and port explicitly: `export LARKSUITE_CLI_AUTH_PROXY=\"127.0.0.1:16384\"`.","Remember the client dials the sidecar — a wildcard/empty listen-style host is not valid here; use 127.0.0.1, localhost, [::1], or a same-host alias.","Check the value end-to-end (`echo \"$LARKSUITE_CLI_AUTH_PROXY\"`) for truncation from quoting or newlines.","Prefer the explicit scheme form `http://127.0.0.1:16384` to avoid bare-address parsing pitfalls."],"exampleFix":"// before\nexport LARKSUITE_CLI_AUTH_PROXY=\":16384\"\n// after\nexport LARKSUITE_CLI_AUTH_PROXY=\"127.0.0.1:16384\"","handlingStrategy":"validation","validationCode":"host, port, err := net.SplitHostPort(addr) // scheme-less values only\nif err != nil || host == \"\" || port == \"\" {\n\treturn fmt.Errorf(\"proxy %q must be host:port with both parts, e.g. 127.0.0.1:16384\", addr)\n}","typeGuard":null,"tryCatchPattern":"if err := sidecar.ValidateProxyAddr(addr); err != nil {\n\tif strings.Contains(err.Error(), \"host and port must not be empty\") {\n\t\treturn fmt.Errorf(\"incomplete address %q; use 127.0.0.1:16384 (client dial address, not a listen wildcard)\", addr)\n\t}\n\treturn err\n}","preventionTips":["Never reuse a server/listen-style address (\":port\") as the client proxy value.","Always specify an explicit loopback or same-host alias host.","Echo the env value before startup to catch truncated quoting.","Prefer the http:// scheme form so parsing is unambiguous."],"tags":["configuration","proxy-address","sidecar"],"backgroundTag":"invalid-proxy-address","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}