{"record":{"id":"53a7545e3cda170d","repo":"Tencent/WeKnora","slug":"w-for-private-deployments-on-internal-networks","errorCode":null,"errorMessage":"%w (for private deployments on internal networks, add the hostname to SSRF_WHITELIST)","messagePattern":"%w \\(for private deployments on internal networks, add the hostname to SSRF_WHITELIST\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/im/feishu/adapter.go","lineNumber":106,"sourceCode":"}\n\n// validateAPIBaseURL checks that a custom Feishu/Lark API base URL uses an\n// http(s) scheme and passes SSRF validation. Empty or the region default is\n// allowed without further checks. Mirrors wecom.validateEndpointURL but allows\n// plain http for internal-network reverse proxies that terminate TLS at nginx.\nfunc validateAPIBaseURL(endpoint, defaultEndpoint string) error {\n\tif endpoint == \"\" || endpoint == defaultEndpoint {\n\t\treturn nil\n\t}\n\tu, err := url.Parse(endpoint)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid api_base_url: %w\", err)\n\t}\n\tif u.Scheme != \"http\" && u.Scheme != \"https\" {\n\t\treturn fmt.Errorf(\"api_base_url must use http(s):// scheme, got %s://\", u.Scheme)\n\t}\n\tif err := utils.ValidateURLForSSRF(endpoint); err != nil {\n\t\treturn fmt.Errorf(\"%w (for private deployments on internal networks, add the hostname to SSRF_WHITELIST)\", err)\n\t}\n\treturn nil\n}\n\n// api builds an Open Platform API URL on this adapter's cloud. path is a format\n// string beginning with \"/open-apis/\"; args fill its verbs.\nfunc (a *Adapter) api(path string, args ...any) string {\n\treturn a.apiBaseURL + fmt.Sprintf(path, args...)\n}\n\n// startStreamReaper starts a background goroutine (once) that periodically\n// removes orphaned stream entries from feishuStreams. This prevents memory\n// leaks when EndStream is never called due to panics or pipeline errors.\nfunc startStreamReaper() {\n\tstartReaperOnce.Do(func() {\n\t\tgo func() {\n\t\t\tticker := time.NewTicker(streamReaperInterval)\n\t\t\tdefer ticker.Stop()","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/im/feishu/adapter.go#L88-L124","documentation":"validateAPIBaseURL rejects a configured Feishu api_base_url whose hostname fails SSRF validation (private/loopback/link-local addresses). The library enforces this to prevent server-side request forgery against internal networks. The wrapped error tells you how to opt in for legitimate private deployments.","triggerScenarios":"NewAdapter is constructed with an api_base_url pointing at a private IP, localhost, or other SSRF-blocked host (e.g. self-hosted Feishu on 10.x/192.168.x/internal DNS), and the hostname is not listed in SSRF_WHITELIST.","commonSituations":"Self-hosting against an internal Feishu/Lark deployment; pointing api_base_url at localhost in development; DNS resolving to an internal address; SSRF_WHITELIST env var not set in the deployment environment.","solutions":["Add the deployment hostname to the SSRF_WHITELIST environment variable","If targeting public Feishu, remove or fix the custom api_base_url so it uses the official https://open.feishu.cn endpoint","Ensure api_base_url is a valid http(s) URL pointing at a public host"],"exampleFix":"// before\nadapter, err := NewAdapter(ctx, cfg) // api_base_url: http://feishu.internal\n// after\n// set SSRF_WHITELIST=feishu.internal in the environment, or:\ncfg.APIBaseURL = \"https://open.feishu.cn\"","handlingStrategy":"validation","validationCode":"u, err := url.Parse(cfg.APIBaseURL)\nif err != nil || (u.Scheme != \"http\" && u.Scheme != \"https\") {\n    return fmt.Errorf(\"bad api_base_url: %q\", cfg.APIBaseURL)\n}\n// ensure host is public or listed in SSRF_WHITELIST before constructing","typeGuard":null,"tryCatchPattern":"adapter, err := NewAdapter(ctx, cfg)\nif err != nil && strings.Contains(err.Error(), \"SSRF_WHITELIST\") {\n    return fmt.Errorf(\"api_base_url host blocked by SSRF guard: %w\", err)\n}","preventionTips":["Keep the official Feishu endpoint unless you truly self-host","Document SSRF_WHITELIST in deployment env templates","Pre-flight the base URL in config tests"],"tags":["ssrf","configuration","security","feishu"],"backgroundTag":"ssrf-validation-failed","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}