{"record":{"id":"58ab6681c8c9465a","repo":"JuliusBrussee/caveman","slug":"ssrf-invalid-url","errorCode":null,"errorMessage":"ssrf: invalid URL","messagePattern":"ssrf: invalid URL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/ssrf/ssrf.go","lineNumber":164,"sourceCode":"\n// SelfHostedConfig returns a Config with ManagedMode disabled and the given\n// allowlist.\nfunc SelfHostedConfig(allowList ...string) Config {\n\treturn Config{ManagedMode: false, AllowList: allowList}\n}\n\n// ValidateURL resolves raw to a URL, validates the scheme/port constraints,\n// and checks every IP the hostname resolves to against the SSRF block lists.\n// It is a pre-flight check only — see NewDialContext for dial-time enforcement.\n//\n// Errors are safe to return to callers; they contain the blocked IP but never\n// the original credential material.\nfunc ValidateURL(ctx context.Context, raw string, cfg Config) error {\n\tu, err := url.Parse(raw)\n\tif err != nil {\n\t\t// net/url.Error includes the raw URL (and may therefore include\n\t\t// credentials or query secrets). Keep this error field-only and stable.\n\t\treturn errors.New(\"ssrf: invalid URL\")\n\t}\n\tif u.Scheme != \"https\" && !(u.Scheme == \"http\" && !cfg.ManagedMode) {\n\t\treturn fmt.Errorf(\"ssrf: scheme %q not permitted (managed mode requires https)\", u.Scheme)\n\t}\n\tif u.User != nil {\n\t\treturn fmt.Errorf(\"ssrf: credentials embedded in URL are forbidden\")\n\t}\n\thost := u.Hostname()\n\tif host == \"\" {\n\t\treturn fmt.Errorf(\"ssrf: URL must contain a host\")\n\t}\n\tport := u.Port()\n\tif cfg.ManagedMode && port != \"\" && port != \"443\" {\n\t\treturn errors.New(\"ssrf: managed mode requires port 443\")\n\t}\n\tif port == \"\" {\n\t\tif u.Scheme == \"https\" {\n\t\t\tport = \"443\"","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/shared/platform/ssrf/ssrf.go#L146-L182","documentation":"Error \"ssrf: invalid URL\" thrown in JuliusBrussee/caveman.","triggerScenarios":"Thrown at shared/platform/ssrf/ssrf.go:164 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide a valid URL."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}