{"record":{"id":"5cf4f7fd2ef95907","repo":"pinpoint-apm/pinpoint","slug":"webhook-url-port-is-not-allowed","errorCode":null,"errorMessage":"Webhook URL port is not allowed","messagePattern":"Webhook URL port is not allowed","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"commons-server/src/main/java/com/navercorp/pinpoint/common/server/webhook/WebhookUrlValidator.java","lineNumber":136,"sourceCode":"    private static void validateAuthority(URI uri) {\n        if (uri.getHost() == null || uri.getHost().isBlank()) {\n            throw new IllegalArgumentException(\"Webhook URL host is required\");\n        }\n        if (isBlockedHostLiteral(uri.getHost())) {\n            throw new IllegalArgumentException(\"Webhook URL host is not allowed\");\n        }\n        if (uri.getRawUserInfo() != null) {\n            throw new IllegalArgumentException(\"Webhook URL user info is not allowed\");\n        }\n        if (uri.getRawFragment() != null) {\n            throw new IllegalArgumentException(\"Webhook URL fragment is not allowed\");\n        }\n        int port = uri.getPort();\n        if (port == -1 && hasExplicitPort(uri)) {\n            throw new IllegalArgumentException(\"Webhook URL port is not valid\");\n        }\n        if (port == 0 || port > MAX_PORT) {\n            throw new IllegalArgumentException(\"Webhook URL port is not allowed\");\n        }\n    }\n\n    private static boolean hasExplicitPort(URI uri) {\n        String rawAuthority = uri.getRawAuthority();\n        if (rawAuthority == null || rawAuthority.isEmpty()) {\n            return false;\n        }\n\n        int hostStartIndex = rawAuthority.lastIndexOf('@') + 1;\n        if (rawAuthority.charAt(hostStartIndex) == '[') {\n            int hostEndIndex = rawAuthority.indexOf(']', hostStartIndex);\n            return hostEndIndex >= 0\n                    && hostEndIndex + 1 < rawAuthority.length()\n                    && rawAuthority.charAt(hostEndIndex + 1) == ':';\n        }\n        return rawAuthority.indexOf(':', hostStartIndex) >= 0;\n    }","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/pinpoint-apm/pinpoint/blob/744c3d3075e595656abb1ae331ad2c0e4c9eb996/commons-server/src/main/java/com/navercorp/pinpoint/common/server/webhook/WebhookUrlValidator.java#L118-L154","documentation":"WebhookUrlValidator.validateAuthority rejects webhook URLs whose explicit port number is outside the legal 1-65535 range (port 0 or above MAX_PORT). Java's URI parser accepts these syntactically, so the validator enforces the RFC port bound before the URL is used for outbound webhook calls. It is a defensive SSRF/input-validation check.","triggerScenarios":"Calling WebhookUrlValidator.validateUriSyntax (via validate) with a URI whose getPort() returns 0 or a value > 65535, e.g. 'http://host:0/hook' or 'http://host:70000/hook'.","commonSituations":"Hand-edited webhook config where a port digit was mistyped (extra digit), templated URLs where an empty port placeholder rendered as 0, or programmatic URL construction with an uninitialized port variable.","solutions":["Correct the port in the webhook URL to a value between 1 and 65535.","If the port is intentionally default, remove the ':port' part entirely so uri.getPort() returns -1.","Validate the port in configuration before passing the URL string to the validator (1 <= port <= 65535)."],"exampleFix":"// before\nString url = \"http://example.com:70000/webhook\";\n// after\nString url = \"http://example.com:8080/webhook\";","handlingStrategy":"validation","validationCode":"URI u = URI.create(url);\nint port = u.getPort();\nif (port != -1 && (port < 1 || port > 65535)) {\n    throw new IllegalArgumentException(\"webhook port out of range: \" + port);\n}","typeGuard":"boolean isValidPort(URI u) { int p = u.getPort(); return p == -1 || (p >= 1 && p <= 65535); }","tryCatchPattern":"try {\n    WebhookUrlValidator.validate(uri);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Invalid webhook URL, rejecting: {}\", e.getMessage());\n}","preventionTips":["Validate webhook URLs at config load time, not just at send time","Keep ports in the 1-65535 range and omit ':0' placeholders","Unit-test webhook URL parsing with malformed ports"],"tags":["url-validation","webhook","input-validation","port"],"backgroundTag":"invalid-url","analyzedSha":"744c3d3075e595656abb1ae331ad2c0e4c9eb996","analyzedAt":"2026-09-07T18:48:45.289Z","contentChangedAt":"2026-09-07T18:48:45.289Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}