{"record":{"id":"5a52ba53e200ed71","repo":"cloudflare/cloudflared","slug":"no-prefix-provided","errorCode":null,"errorMessage":"no prefix provided","messagePattern":"no prefix provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ipaccess/access.go","lineNumber":37,"sourceCode":"\nfunc NewPolicy(defaultAllow bool, rules []Rule) (*Policy, error) {\n\tfor _, rule := range rules {\n\t\tif err := rule.Validate(); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\tpolicy := Policy{\n\t\tdefaultAllow: defaultAllow,\n\t\trules:        rules,\n\t}\n\n\treturn &policy, nil\n}\n\nfunc NewRuleByCIDR(prefix *string, ports []int, allow bool) (Rule, error) {\n\tif prefix == nil || len(*prefix) == 0 {\n\t\treturn Rule{}, fmt.Errorf(\"no prefix provided\")\n\t}\n\n\t_, ipnet, err := net.ParseCIDR(*prefix)\n\tif err != nil {\n\t\treturn Rule{}, fmt.Errorf(\"unable to parse cidr: %s\", *prefix)\n\t}\n\n\treturn NewRule(ipnet, ports, allow)\n}\n\nfunc NewRule(ipnet *net.IPNet, ports []int, allow bool) (Rule, error) {\n\trule := Rule{\n\t\tipNet: ipnet,\n\t\tports: ports,\n\t\tallow: allow,\n\t}\n\treturn rule, rule.Validate()\n}","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ipaccess/access.go#L19-L55","documentation":"ipaccess.NewRuleByCIDR requires a non-nil, non-empty CIDR prefix string. If the prefix pointer is nil or the string is empty, no rule can be built and this error is returned immediately, before CIDR parsing.","triggerScenarios":"Calling NewRuleByCIDR(nil, ports, allow) or NewRuleByCIDR(&empty, ...), or indirectly through validateIngress / setIPRules / originRequestFromConfig when an ipRules entry lacks a prefix field.","commonSituations":"YAML ipRules entries with the `prefix` key omitted or mis-indented so it deserializes to nil, or programmatic construction of rules with an unset prefix.","solutions":["Provide a valid prefix (CIDR string) for every ipRules entry, e.g. `prefix: 10.0.0.0/8`","Check YAML indentation so each entry's prefix key is actually populated","Validate prefix presence programmatically before calling NewRuleByCIDR"],"exampleFix":"// before\nipRules:\n  - ports: [80]\n    allow: true\n// after\nipRules:\n  - prefix: 10.0.0.0/8\n    ports: [80]\n    allow: true","handlingStrategy":"validation","validationCode":"func validPrefix(p *string) bool {\n\treturn p != nil && len(*p) > 0 && func() bool { _, _, err := net.ParseCIDR(*p); return err == nil }()\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Make prefix a required field in your config schema","Default to 0.0.0.0/0 explicitly rather than omitting","Lint ipRules entries before applying configs"],"tags":["ip-access","cidr","validation"],"backgroundTag":"missing-required-argument","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}