{"record":{"id":"3cd40870a4d11169","repo":"google/tsunami-security-scanner","slug":"invalid-address-family-s","errorCode":null,"errorMessage":"Invalid address family: %s","messagePattern":"Invalid address family: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"plugin_server/py/common/data/network_service_utils.py","lineNumber":184,"sourceCode":"def build_web_app_root_path(network_service: NetworkService) -> str:\n  if network_service.service_context:\n    root_path = network_service.service_context.web_service_context.application_root\n  else:\n    root_path = \"/\"\n  if not root_path.startswith(\"/\"):\n    root_path = \"/\" + root_path\n  if not root_path.endswith(\"/\"):\n    root_path = root_path + \"/\"\n  return root_path\n\n\ndef get_address_family(address_family: socket.AddressFamily) -> AddressFamily:\n  if address_family == socket.AF_INET:\n    return AddressFamily.IPV4\n  elif address_family == socket.AF_INET6:\n    return AddressFamily.IPV6\n  else:\n    raise ValueError(\"Invalid address family: %s\" % address_family)\n\n\ndef sanitize_port(port: Optional[int], scheme: str) -> int:\n  if isinstance(port, type(None)):\n    return get_port(-1, scheme)\n  return get_port(port, scheme)\n\n\ndef get_port(port: int, scheme: str) -> int:\n  if port >= 0:\n    return port\n  return 80 if scheme == \"http\" else 443\n\n\ndef validate_scheme(scheme: str) -> None:\n  if scheme == \"http\" or scheme == \"https\":\n    pass\n  else:","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/google/tsunami-security-scanner/blob/363ba87b3543f8ae8e4304d3416818f03da7f262/plugin_server/py/common/data/network_service_utils.py#L166-L202","documentation":"get_address_family() converts a Python socket.AddressFamily to Tsunami's AddressFamily enum and raises ValueError for anything other than AF_INET or AF_INET6. Only IPv4 and IPv6 families are supported when building URIs from a NetworkService.","triggerScenarios":"Calling get_address_family (directly or via build_uri_network_service) with a socket address family such as AF_UNIX or AF_LINK at network_service_utils.py:184.","commonSituations":"Network services derived from Unix-domain sockets or link-layer addresses; tests constructing NetworkService with a default/invalid AddressFamily; platform-specific address families leaking into scan data.","solutions":["Only call get_address_family for TCP/UDP services with AF_INET or AF_INET6 addresses.","Filter out non-IP network services (e.g. AF_UNIX) before URI construction.","Inspect the service's address_family value and map any new family explicitly if upstream adds support."],"exampleFix":"// before\nfamily = network_service_utils.get_address_family(service.address_family)\n// after\nif service.address_family in (socket.AF_INET, socket.AF_INET6):\n    family = network_service_utils.get_address_family(service.address_family)","handlingStrategy":"type-guard","validationCode":"if service.address_family not in (socket.AF_INET, socket.AF_INET6): raise SkipService","typeGuard":"def has_ip_family(service) -> bool:\n    return service.address_family in (socket.AF_INET, socket.AF_INET6)","tryCatchPattern":"try:\n    family = network_service_utils.get_address_family(service.address_family)\nexcept ValueError as e:\n    logging.warning(\"Unsupported address family: %s\", e)\n    family = None","preventionTips":["Only construct NetworkServices from AF_INET/AF_INET6 sockets.","Filter out unix/link-layer services before URI building.","Keep tests aligned with supported address families."],"tags":["python","network-service","ipv6","address-family"],"backgroundTag":"invalid-enum-value","analyzedSha":"363ba87b3543f8ae8e4304d3416818f03da7f262","analyzedAt":"2026-09-13T01:50:53.990Z","contentChangedAt":"2026-09-13T01:50:53.990Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}