{"record":{"id":"4cc41931cc2d0ad0","repo":"larksuite/cli","slug":"invalid-s-q-query-is-not-allowed","errorCode":null,"errorMessage":"invalid %s %q: query is not allowed","messagePattern":"invalid (.+?) %q: query is not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/transport/config.go","lineNumber":218,"sourceCode":"\tif u.Scheme != \"http\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: scheme must be http\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Host == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: missing host\", envvars.CliProxyAddress, redacted)\n\t}\n\t// Security hardening: only allow a loopback proxy. This prevents accidental\n\t// cross-machine proxying of credentials/traffic.\n\tif u.Hostname() != \"127.0.0.1\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: host must be 127.0.0.1\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Port() == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: explicit port is required\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Path != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: path is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.RawQuery != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: query is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Fragment != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: fragment is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\treturn u, nil\n}\n\n// ApplyToTransport clones base and applies proxy plugin settings to the clone.\n// Caller owns the returned *http.Transport.\nfunc (c *Config) ApplyToTransport(base *http.Transport) (*http.Transport, error) {\n\tif base == nil {\n\t\tbase = http.DefaultTransport.(*http.Transport)\n\t}\n\tu, err := c.proxyURL()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/transport/config.go#L200-L236","documentation":"The proxy address must be a bare origin with no fragment. proxyURL rejects URLs with a `#...` suffix, showing a redacted address. Fragments are meaningless for a fixed HTTP proxy endpoint and typically indicate a copied web URL.","triggerScenarios":"LARKSUITE_CLI_PROXY_ADDRESS containing `#...` (e.g. http://127.0.0.1:8080#section, or a browser-copied URL with an anchor) while proxy mode is enabled; ApplyToTransport fails at startup.","commonSituations":"Copying a documentation/anchor URL instead of the proxy endpoint; shell scripts where a `#` comment accidentally became part of an unquoted value; templating leftovers.","solutions":["Remove the fragment: `export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080`.","Quote assignments in shell scripts so `#` isn't misinterpreted, and verify with `echo $LARKSUITE_CLI_PROXY_ADDRESS`.","Use the proxy tool's plain listening endpoint, not a web-UI page URL.","Update ~/.lark-cli/proxy_config.json's LARKSUITE_CLI_PROXY_ADDRESS identically if configured there."],"exampleFix":"// before\nexport LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080#setup\n// after\nexport LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080","handlingStrategy":"validation","validationCode":"case \"$LARKSUITE_CLI_PROXY_ADDRESS\" in *'#'*) echo 'proxy address must not contain a fragment' >&2 ;; esac","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Strip anything from '#' onward — fragments are never valid here.","Quote assignments in shell scripts so '#' can't start a comment inside the value.","Don't copy anchor-bearing documentation URLs as the proxy address.","Keep the value a minimal http://127.0.0.1:port literal."],"tags":["proxy","url","config","validation"],"backgroundTag":"invalid-proxy-url","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}