{"record":{"id":"39cddeca3c3c442d","repo":"larksuite/cli","slug":"missing-remote-address","errorCode":null,"errorMessage":"missing remote address","messagePattern":"missing remote address","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/validate/url.go","lineNumber":553,"sourceCode":"\tvar d net.Dialer\n\treturn d.DialContext(ctx, network, addr)\n}\n\nfunc downloadTargetPolicyError(err error) error {\n\treturn errs.NewSecurityPolicyError(\n\t\terrs.SubtypeAccessDenied,\n\t\t\"blocked download target: %v\",\n\t\terr,\n\t).WithCause(err)\n}\n\nfunc validateConnRemoteIP(conn net.Conn) error {\n\tif conn == nil {\n\t\treturn fmt.Errorf(\"nil connection\")\n\t}\n\traddr := conn.RemoteAddr()\n\tif raddr == nil {\n\t\treturn fmt.Errorf(\"missing remote address\")\n\t}\n\thost, _, err := net.SplitHostPort(raddr.String())\n\tif err != nil {\n\t\thost = raddr.String()\n\t}\n\tip := net.ParseIP(strings.Trim(host, \"[]\"))\n\tif ip == nil {\n\t\treturn fmt.Errorf(\"invalid remote IP\")\n\t}\n\tif isRestrictedDownloadIP(ip) {\n\t\treturn fmt.Errorf(\"local/internal host is not allowed\")\n\t}\n\treturn nil\n}\n","sourceCodeStart":535,"sourceCodeEnd":568,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/validate/url.go#L535-L568","documentation":"After confirming the connection is non-nil, validateConnRemoteIP reads RemoteAddr() to learn the actual peer IP the OS connected to. This error means RemoteAddr() returned nil, which can happen for exotic or half-built connections where the address was never populated. The validator refuses to approve a connection whose peer is unknown.","triggerScenarios":"The established net.Conn reports a nil RemoteAddr — e.g. a custom/wrapped conn implementation that does not implement RemoteAddr properly, or a connection created outside the normal net.Dialer path.","commonSituations":"Custom net.Conn wrappers (logging/tracing decorators) that forget to forward RemoteAddr; mocks in tests; unusual transport customizations on the download client.","solutions":["Use the standard net.Dialer-produced connection whose RemoteAddr is always populated","Fix any custom net.Conn wrapper to forward RemoteAddr() to the underlying connection","Update test mocks to return a realistic *net.TCPAddr from RemoteAddr"],"exampleFix":"// before\nfunc (c *loggingConn) RemoteAddr() net.Addr { return nil }\n// after\nfunc (c *loggingConn) RemoteAddr() net.Addr { return c.Conn.RemoteAddr() }","handlingStrategy":"type-guard","validationCode":"if conn == nil { return errors.New(\"nil connection\") }\nif conn.RemoteAddr() == nil { return errors.New(\"conn wrapper does not forward RemoteAddr\") }","typeGuard":"func hasRemoteAddr(conn net.Conn) bool {\n    return conn != nil && conn.RemoteAddr() != nil\n}","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"missing remote address\") {\n    return fmt.Errorf(\"connection wrapper hides RemoteAddr; unwrap or fix the conn decorator: %w\", err)\n}","preventionTips":["When decorating net.Conn, forward all methods including RemoteAddr/LocalAddr","Avoid exotic conn types in the download client; use standard net.Dialer output","Add a smoke test that RoundTrip works through any conn wrapper you introduce"],"tags":["network","ssrf","connection","validation"],"backgroundTag":"missing-remote-addr","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}