{"record":{"id":"9343b78e85faf314","repo":"lionsoul2014/ip2region","slug":"invalid-ip-address-ip","errorCode":null,"errorMessage":"invalid ip address `${ip}`","messagePattern":"invalid ip address `(.+?)`","errorType":"validation","errorClass":"InetAddressException","httpStatus":null,"severity":"warning","filePath":"binding/java/src/main/java/org/lionsoul/ip2region/xdb/Util.java","lineNumber":22,"sourceCode":"//\n// @Author Lion <chenxin619315@gmail.com>\n// @Date   2022/07/14\n\npackage org.lionsoul.ip2region.xdb;\n\nimport java.net.InetAddress;\nimport java.net.UnknownHostException;\n\npublic class Util\n{\n\n    // parse the specified IP address and return its bytes.\n    // returns: byte[4] for IPv4 and byte[16] for IPv6 and the bytes should be in Big endian order.\n    public static byte[] parseIP(String ip) throws InetAddressException {\n        try {\n            return InetAddress.getByName(ip).getAddress();\n        } catch (UnknownHostException e) {\n            throw new InetAddressException(\"invalid ip address `\"+ip+\"`\");\n        }\n    }\n\n    // convert the byte[] ip to string ip address\n    public static String ipToString(final byte[] ip) {\n        if (ip.length != 4 && ip.length != 16) {\n            return String.format(\"invalid-ip-address-length: %d\", ip.length);\n        }\n\n        try {\n            return InetAddress.getByAddress(ip).getHostAddress();\n        } catch (UnknownHostException e) {\n            return String.format(\"invalid-ip-address `%s`\", ipJoin(ip));\n        }\n    }\n\n    // implode the byte[] ip with its byte value.\n    public static String ipJoin(byte[] ip) {","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/lionsoul2014/ip2region/blob/c1a1fc7d5941760db3f8431dc05c48cf7f0e30a1/binding/java/src/main/java/org/lionsoul/ip2region/xdb/Util.java#L4-L40","documentation":"Util.parseIP delegates to InetAddress.getByName and wraps UnknownHostException into InetAddressException. It throws when the string is not a resolvable literal IP address (IPv4 or IPv6) — note getByName also performs DNS lookup for hostnames, so unresolvable names also fail here.","triggerScenarios":"Passing a malformed string to Util.parseIP (used by Searcher.search(String)): e.g. \"256.1.1.1\", \"\", \"localhost\" without DNS, whitespace, or a CIDR like \"1.2.3.0/24\".","commonSituations":"User-supplied IP inputs (HTTP params, logs) not sanitized before lookup; reading IP fields from CSVs with quotes/spaces; accidentally passing hostnames expecting resolution.","solutions":["Validate/trim the input and ensure it is a literal IPv4/IPv6 address before calling parseIP","Strip port/CIDR suffixes and surrounding whitespace from the string first","Catch InetAddressException at the call site and treat it as invalid user input","Prefer a strict regex or validation library to reject hostnames if DNS resolution is unwanted"],"exampleFix":"// before\nString r = searcher.search(request.getParameter(\"ip\")); // \"1.2.3.4/24\"\n// after\nString ip = request.getParameter(\"ip\").trim().split(\"/\")[0];\ntry {\n    String r = searcher.search(Util.parseIP(ip));\n} catch (InetAddressException e) { /* invalid ip input */ }","handlingStrategy":"try-catch","validationCode":"private static final Pattern IP_PATTERN = Pattern.compile(\"^((25[0-5]|2[0-4]\\\\d|1?\\\\d?\\\\d)\\\\.){3}(25[0-5]|2[0-4]\\\\d|1?\\\\d?\\\\d)$|^([0-9a-fA-F:]+)$\");\nboolean valid = ip != null && IP_PATTERN.matcher(ip.trim()).matches();","typeGuard":"static boolean isLiteralIp(String s) {\n    if (s == null) return false;\n    try { return Util.parseIP(s.trim()).length == 4 || Util.parseIP(s.trim()).length == 16; }\n    catch (Exception e) { return false; }\n}","tryCatchPattern":"try {\n    byte[] ip = Util.parseIP(input.trim());\n    return searcher.search(ip);\n} catch (InetAddressException e) {\n    log.warn(\"invalid ip input: {}\", input);\n    return null;\n}","preventionTips":["Trim and sanitize user-provided IP strings (ports, CIDR, quotes)","Reject hostnames explicitly if you don't want DNS lookups","Validate with a regex before calling Util.parseIP","Log the offending value to make bad-input debugging easy"],"tags":["java","ip-address","input-validation"],"backgroundTag":"invalid-ip-address","analyzedSha":"c1a1fc7d5941760db3f8431dc05c48cf7f0e30a1","analyzedAt":"2026-09-02T16:58:39.988Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}