{"record":{"id":"8d507f67f976a2a2","repo":"Tencent/WeKnora","slug":"unsafe-tos-endpoint-w","errorCode":null,"errorMessage":"unsafe TOS endpoint: %w","messagePattern":"unsafe TOS endpoint: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/file/tos.go","lineNumber":40,"sourceCode":"// tosFileService implements the FileService interface for Volcengine TOS.\ntype tosFileService struct {\n\tclient         *tos.ClientV2\n\tpathPrefix     string\n\tbucketName     string\n\ttempBucketName string\n}\n\nconst tosScheme = \"tos://\"\n\n// NewTosFileService creates a TOS file service.\nfunc NewTosFileService(endpoint, region, accessKey, secretKey, bucketName, pathPrefix string) (interfaces.FileService, error) {\n\treturn NewTosFileServiceWithTempBucket(endpoint, region, accessKey, secretKey, bucketName, pathPrefix, \"\", \"\")\n}\n\n// NewTosFileServiceWithTempBucket creates a TOS file service with optional temp bucket.\nfunc NewTosFileServiceWithTempBucket(endpoint, region, accessKey, secretKey, bucketName, pathPrefix, tempBucketName, tempRegion string) (interfaces.FileService, error) {\n\tif err := utils.ValidateURLForSSRF(endpoint); err != nil {\n\t\treturn nil, fmt.Errorf(\"unsafe TOS endpoint: %w\", err)\n\t}\n\thttpConfig := utils.DefaultSSRFSafeHTTPClientConfig()\n\tclient, err := tos.NewClientV2(\n\t\tendpoint,\n\t\ttos.WithRegion(region),\n\t\ttos.WithCredentials(tos.NewStaticCredentials(accessKey, secretKey)),\n\t\ttos.WithHTTPTransport(&utils.SSRFValidatingRoundTripper{\n\t\t\tBase: utils.NewSSRFSafeTransport(httpConfig),\n\t\t}),\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to initialize TOS client: %w\", err)\n\t}\n\n\tif err := ensureTOSBucket(client, bucketName); err != nil {\n\t\treturn nil, err\n\t}\n","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/file/tos.go#L22-L58","documentation":"NewTosFileServiceWithTempBucket validates the TOS endpoint with utils.ValidateURLForSSRF before creating the client; this error wraps that validation failure. The endpoint URL was judged unsafe — e.g. pointing at localhost, a private/link-local IP, or otherwise invalid scheme — to prevent server-side request forgery. Service construction aborts.","triggerScenarios":"Constructing the TOS service (directly or via NewFileServiceFromStorageConfig/NewTosFileService/initRawFileService) with an endpoint that is http to an internal host, resolves to a private/loopback address, or is an unparseable URL.","commonSituations":"Config pointing TOS endpoint at 'http://localhost:9000' or an internal IP in dev; typo like 'tos://bucket' instead of a host; missing scheme in the endpoint env var; SSRF guard newly enabled rejecting previously accepted internal endpoints.","solutions":["Set the endpoint to a valid public TOS endpoint with proper scheme (e.g. https://tos-cn-beijing.volces.com)","Inspect the wrapped ValidateURLForSSRF error to see which rule (scheme, private IP, loopback) rejected it","If internal endpoints are required, use the sanctioned internal endpoint/allowlist mechanism rather than bypassing SSRF checks","Fix the storage config/env var supplying the endpoint (typos, missing scheme)"],"exampleFix":"// before\nendpoint := os.Getenv(\"TOS_ENDPOINT\") // \"localhost:9000\"\nsvc, err := file.NewTosFileService(endpoint, ...)\n// after\nendpoint := os.Getenv(\"TOS_ENDPOINT\") // \"https://tos-cn-beijing.volces.com\"\nif u, err := url.Parse(endpoint); err != nil || u.Host == \"\" {\n    return fmt.Errorf(\"invalid TOS_ENDPOINT %q\", endpoint)\n}\nsvc, err := file.NewTosFileService(endpoint, ...)","handlingStrategy":"validation","validationCode":"u, err := url.Parse(endpoint)\nif err != nil || u.Host == \"\" { return fmt.Errorf(\"bad endpoint %q\", endpoint) }\nif err := utils.ValidateURLForSSRF(endpoint); err != nil {\n    return fmt.Errorf(\"endpoint rejected: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"svc, err := file.NewTosFileServiceWithTempBucket(endpoint, ...)\nif err != nil && strings.Contains(err.Error(), \"unsafe TOS endpoint\") {\n    log.Fatalf(\"TOS_ENDPOINT %q failed SSRF validation: %v\", endpoint, err)\n}","preventionTips":["Use full public TOS endpoints with https scheme in all env configs","Never point storage endpoints at localhost/private IPs in production","Fail fast at config load by constructing services during boot","Read the wrapped ValidateURLForSSRF error to know which rule rejected the URL"],"tags":["security","ssrf","tos","configuration"],"backgroundTag":"ssrf-endpoint-rejected","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}