{"record":{"id":"62c0aa268c4f1482","repo":"iflytek/astron-agent","slug":"model-url-check-failed-responseenum","errorCode":"MODEL_URL_CHECK_FAILED","errorMessage":"ResponseEnum.MODEL_URL_CHECK_FAILED","messagePattern":"ResponseEnum\\.MODEL_URL_CHECK_FAILED","errorType":"error_code","errorClass":"BusinessException","httpStatus":null,"severity":"error","filePath":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowService.java","lineNumber":2172,"sourceCode":"            final boolean isAgent = node.getId().startsWith(WorkflowConst.NodeType.AGENT);\n            final String url = isAgent\n                    ? Optional.ofNullable(nodeParam.getJSONObject(\"modelConfig\")).map(o -> o.getString(\"api\")).orElse(null)\n                    : nodeParam.getString(\"url\");\n            if (StringUtils.isBlank(url)) {\n                continue;\n            }\n            ensureHttpLikeScheme(url);\n            try {\n                SsrfValidators.Normalized n = SsrfValidators.normalizeFlex(SsrfValidators.stripUserInfo(url));\n                URL norm = n.effectiveUrl;\n                String rebuilt = SsrfValidators.rebuildWithOriginalScheme(norm, n.originalScheme, n.wsLike);\n                String hostOnly = rebuilt + \"://\" + norm.getHost() + (norm.getPort() != -1 ? (\":\" + norm.getPort()) : \"\");\n                ssrfGuard.validateUrlParam(hostOnly);\n            } catch (BusinessException e) {\n                throw e;\n            } catch (Exception e) {\n                log.error(\"workflow model url check failed :\", e);\n                throw new BusinessException(ResponseEnum.MODEL_URL_CHECK_FAILED);\n            }\n        }\n    }\n\n    private List<String> loadIpRules(String category) {\n        List<ConfigInfo> cfgList = configInfoMapper.getListByCategory(category);\n        if (cfgList == null || cfgList.isEmpty() || StringUtils.isBlank(cfgList.get(0).getValue())) {\n            return Collections.emptyList();\n        }\n        return Arrays.stream(cfgList.get(0).getValue().split(\",\"))\n                .map(String::trim)\n                .filter(StringUtils::isNotBlank)\n                .distinct()\n                .toList();\n    }\n\n    private void ensureHttpLikeScheme(String url) {\n        String lower = StringUtils.left(url.trim(), 6).toLowerCase(Locale.ROOT);","sourceCodeStart":2154,"sourceCodeEnd":2190,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowService.java#L2154-L2190","documentation":"Generic failure wrapper for SSRF validation of model URLs inside workflow validation. When rebuilding/normalizing a model URL and validating host/IP rules via ssrfGuard.validateUrlParam throws an unexpected (non-Business) exception, it is logged and rethrown as MODEL_URL_CHECK_FAILED. BusinessExceptions from the guard are passed through unchanged.","triggerScenarios":"Model endpoint URL that fails URL normalization/parsing (malformed URI syntax, invalid host or port) during the check; unexpected exception inside the SSRF guard or IP-rule loading.","commonSituations":"Typos in the model URL (missing scheme fragments, invalid port); URLs with characters URI.create rejects; DNS/IP-rule subsystem misconfigured so rule loading throws.","solutions":["Check the log line 'workflow model url check failed' for the underlying exception","Correct the model URL: valid scheme, hostname, and port (e.g. https://host:8443)","Confirm the host is not an internal/SSRF-protected address if the guard rejects it","Verify the config-driven IP rules load correctly (configInfoMapper data intact)"],"exampleFix":"// before\nString url = \"https://model host:notaport/v1\";\n// after\nString url = \"https://model-host:8443/v1\";","handlingStrategy":"validation","validationCode":"try { new URI(url); } catch (URISyntaxException e) { throw new IllegalArgumentException(\"malformed model url: \" + url); }","typeGuard":null,"tryCatchPattern":"try { workflowService.save(req); } catch (BusinessException e) { if (\"MODEL_URL_CHECK_FAILED\".equals(e.getCode().name())) { /* inspect and fix URL */ } throw e; }","preventionTips":["Validate model URLs with a URL parser before submitting","Ensure hosts/ports are syntactically valid","Keep SSRF IP-rule configuration data intact"],"tags":["ssrf","url-validation","security"],"backgroundTag":"invalid-url","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}