{"record":{"id":"7e9829f882e2d622","repo":"iflytek/astron-agent","slug":"response-failed-only-allowed-schemes-props-getallowedschemes","errorCode":"RESPONSE_FAILED","errorMessage":"Only allowed schemes: ${props.getAllowedSchemes()}","messagePattern":"Only allowed schemes: (.+?)","errorType":"error_code","errorClass":"BusinessException","httpStatus":null,"severity":"warning","filePath":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/util/ssrf/SsrfParamGuard.java","lineNumber":60,"sourceCode":"     * <li>Check if the URL scheme (protocol) is allowed.</li>\n     * <li>Check if the host is blocked by the configured IP blacklist (supporting both hostnames and\n     * IPs).</li>\n     * </ul>\n     *\n     * @param url the URL string to validate\n     * @throws BusinessException if the URL does not pass validation\n     */\n    public void validateUrlParam(String url) {\n        try {\n            SsrfValidators.Normalized n = SsrfValidators.normalizeFlex(url);\n            URL u = n.effectiveUrl;\n\n            // 1) Protocol and port\n            if (!SsrfValidators.isAllowedScheme(u.getProtocol(), props.getAllowedSchemes())) {\n                throw new BusinessException(ResponseEnum.MODEL_URL_ILLEGAL_FAILED);\n            }\n            if (!SsrfValidators.isAllowedScheme(u.getProtocol(), props.getAllowedSchemes())) {\n                throw new BusinessException(\n                        ResponseEnum.RESPONSE_FAILED,\n                        \"Only allowed schemes: \" + props.getAllowedSchemes());\n            }\n\n            // 2) IP blacklist (compatible with hostnames and IPs)\n            List<String> ipBlacklist = props.getIpBlaklist();\n            if (SsrfValidators.isHostDeniedByIpPolicy(\n                    u.getHost(), ipBlacklist, props.getIpWhitelist(), Dns.SYSTEM)) {\n                throw new BusinessException(ResponseEnum.MODEL_URL_CHECK_FAILED);\n            }\n\n        } catch (BusinessException e) {\n            throw e;\n        } catch (Exception e) {\n            log.error(\"[SSRF] URL validation failed\", e);\n            throw new BusinessException(ResponseEnum.MODEL_URL_ILLEGAL_FAILED);\n        }\n    }","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/util/ssrf/SsrfParamGuard.java#L42-L78","documentation":"The second, duplicated scheme check in validateUrlParam throws a generic RESPONSE_FAILED with message 'Only allowed schemes: <list>'. It is unreachable in practice for scheme violations because the identical if-condition on the previous lines already throws MODEL_URL_ILLEGAL_FAILED first.","triggerScenarios":"Only if the first check were removed or refactored: same condition — u.getProtocol() not in props.getAllowedSchemes() during buildModelApiUrlNew/validateSsrfForNodes.","commonSituations":"Developers reading logs may see the duplicated guard and be confused which error surfaces; in current code this branch is dead code.","solutions":["Fix the model URL to use an allowed scheme (see MODEL_URL_ILLEGAL_FAILED).","Remove the duplicate dead branch or change it to list allowed schemes for a more helpful message.","Align allowed-schemes config with the schemes actually used by model endpoints."],"exampleFix":"// before (dead duplicate)\nif (!SsrfValidators.isAllowedScheme(u.getProtocol(), props.getAllowedSchemes())) {\n    throw new BusinessException(ResponseEnum.RESPONSE_FAILED, \"Only allowed schemes: \" + props.getAllowedSchemes());\n}\n// after\n// delete the duplicate branch; the first check already rejects with MODEL_URL_ILLEGAL_FAILED","handlingStrategy":"validation","validationCode":"java.net.URI uri = java.net.URI.create(url);\nSet<String> allowed = Set.of(\"http\", \"https\");\nboolean ok = uri.getScheme() != null && allowed.contains(uri.getScheme().toLowerCase());","typeGuard":null,"tryCatchPattern":"try {\n    ssrfParamGuard.validateUrlParam(url);\n} catch (BusinessException e) {\n    log.error(\"URL rejected: {}\", e.getMessage());\n    throw e;\n}","preventionTips":["Prefer endpoints with well-formed absolute URLs.","Remove duplicate validation branches to avoid confusion.","Centralize scheme checks in one helper."],"tags":["security","ssrf","dead-code","url-validation"],"backgroundTag":"invalid-url","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}