{"record":{"id":"666cfbbb6dd9cc70","repo":"larksuite/cli","slug":"invalid-s-q-path-is-not-allowed","errorCode":null,"errorMessage":"invalid %s %q: path is not allowed","messagePattern":"invalid (.+?) %q: path is not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/transport/config.go","lineNumber":215,"sourceCode":"\t\t// generic message instead.\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: malformed URL\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Scheme != \"http\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: scheme must be http\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Host == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: missing host\", envvars.CliProxyAddress, redacted)\n\t}\n\t// Security hardening: only allow a loopback proxy. This prevents accidental\n\t// cross-machine proxying of credentials/traffic.\n\tif u.Hostname() != \"127.0.0.1\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: host must be 127.0.0.1\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Port() == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: explicit port is required\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Path != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: path is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.RawQuery != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: query is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Fragment != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: fragment is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\treturn u, nil\n}\n\n// ApplyToTransport clones base and applies proxy plugin settings to the clone.\n// Caller owns the returned *http.Transport.\nfunc (c *Config) ApplyToTransport(base *http.Transport) (*http.Transport, error) {\n\tif base == nil {\n\t\tbase = http.DefaultTransport.(*http.Transport)\n\t}\n\tu, err := c.proxyURL()\n\tif err != nil {","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/transport/config.go#L197-L233","documentation":"The proxy address must be a bare origin with no query string. proxyURL rejects URLs like http://127.0.0.1:8080?foo=bar, showing a redacted address. A query has no meaning for a fixed HTTP proxy endpoint and usually indicates the wrong string was pasted.","triggerScenarios":"LARKSUITE_CLI_PROXY_ADDRESS containing a `?...` suffix (e.g. a copied URL with tracking params or a token in the query) while proxy mode is enabled; ApplyToTransport fails at startup.","commonSituations":"Copying a full URL from a browser address bar (query included); appending credentials as query parameters; templating that leaves `?port=8080` style suffixes.","solutions":["Remove the query string: `export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080`.","If you were putting a token in the query, move it into your proxy tool's own config file — the CLI proxy address accepts none.","Inspect the value: `echo $LARKSUITE_CLI_PROXY_ADDRESS` and strip everything from `?` onward.","Mirror the fix in ~/.lark-cli/proxy_config.json if the address is set there."],"exampleFix":"// before\nexport LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080?token=abc\n// after\nexport LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080","handlingStrategy":"validation","validationCode":"case \"$LARKSUITE_CLI_PROXY_ADDRESS\" in *\\?*) echo 'proxy address must not contain a query string' >&2 ;; esac","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Strip everything from '?' onward — the address is a bare origin only.","Don't pass tokens/credentials as query parameters; configure them in the proxy tool itself.","Avoid pasting URLs straight from a browser address bar.","Keep the value a minimal http://127.0.0.1:port literal."],"tags":["proxy","url","config","validation"],"backgroundTag":"invalid-proxy-url","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}