{"record":{"id":"94baf6d53afeb810","repo":"jeecgboot/JeecgBoot","slug":"ipv4-ip","errorCode":null,"errorMessage":"非法IPv4地址: {ip}","messagePattern":"非法IPv4地址: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"warning","filePath":"jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/filter/ApiAuthFilter.java","lineNumber":177,"sourceCode":"        }\n        for (int i = 0; i < 4; i++) {\n            if (\"*\".equals(patternParts[i])) {\n                continue;\n            }\n            if (!ipParts[i].equals(patternParts[i])) {\n                return false;\n            }\n        }\n        return true;\n    }\n\n    /**\n     * IPv4地址转long\n     */\n    private long ipToLong(String ip) {\n        String[] parts = ip.split(\"\\\\.\");\n        if (parts.length != 4) {\n            throw new IllegalArgumentException(\"非法IPv4地址: \" + ip);\n        }\n        long result = 0;\n        for (int i = 0; i < 4; i++) {\n            result = (result << 8) | (Integer.parseInt(parts[i]) & 0xFF);\n        }\n        return result;\n    }\n    //update-end---author:scott ---date:20260416  for：【PR/9083】OpenAPI白名单增强，支持CIDR网段和通配符匹配-----------\n\n    /**\n     * 签名验证\n     * @param appkey\n     * @param signature\n     * @param timestamp\n     * @return\n     */\n    protected void checkSignValid(String appkey, String signature, String timestamp) {\n        if (!StringUtils.hasText(appkey)) {","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/filter/ApiAuthFilter.java#L159-L195","documentation":"Thrown by ApiAuthFilter.ipToLong when an IPv4 string passed to CIDR matching does not split into exactly 4 octets. Note: ipToLong is only reached via isCidrMatch, which wraps the call in try/catch(Exception) and returns false on failure, so in practice this exception is swallowed and logged as a warning - it surfaces as a CIDR non-match (which then may bubble up as error 146 'IP not in whitelist'), not directly to the client.","triggerScenarios":"Configuring a CIDR entry like '192.168.1/24' (missing an octet), '10.0.0.0.0/8' (extra octet), or a non-numeric value; the caller IP itself is IPv6 or malformed.","commonSituations":"Typo in the whitelist CIDR; IPv6-only client whose '::1' style address is fed into the IPv4-only matcher; database migration that mangled the white_list column.","solutions":["Correct the CIDR entry to a valid 4-octet/prefix form: '192.168.1.0/24'.","If clients are IPv6, note the matcher is IPv4-only; restrict to IPv4 clients or extend the matcher.","Inspect logs for 'CIDR匹配解析失败: cidr=..., ip=...' warnings to locate the offending entry."],"exampleFix":"// before: white_list = \"192.168.1/24\"\n// after:  white_list = \"192.168.1.0/24\"","handlingStrategy":"validation","validationCode":"// Validate CIDR entries before saving them into white_list\nprivate static boolean isValidCidr(String cidr) {\n    String[] p = cidr.split(\"/\");\n    if (p.length != 2) return false;\n    String[] oct = p[0].split(\"\\\\.\");\n    if (oct.length != 4) return false;\n    try { Integer.parseInt(p[1]); } catch (Exception e) { return false; }\n    return true;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always use 4-octet CIDR form (e.g. 192.168.1.0/24).","Note the matcher is IPv4-only; do not put IPv6 entries in the whitelist.","Watch logs for 'CIDR匹配解析失败' warnings to catch malformed entries early."],"tags":["openapi","ip-whitelist","ipv4","input-validation"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}