{"record":{"id":"95084d61f16bb25f","repo":"elastic/elasticsearch","slug":"78-95084d","errorCode":"78","errorMessage":"Malformed [proxy], expected [host:port]","messagePattern":"Malformed \\[proxy\\], expected \\[host:port\\]","errorType":"exception","errorClass":"UserException","httpStatus":null,"severity":"error","filePath":"distribution/tools/plugin-cli/src/main/java/org/elasticsearch/plugins/cli/ProxyUtils.java","lineNumber":39,"sourceCode":" * Utilities for working with HTTP proxies.\n */\nclass ProxyUtils {\n    /**\n     * Constructs a proxy from the given string. If {@code null} is passed, then {@code null} will\n     * be returned, since that is not the same as {@link Proxy#NO_PROXY}.\n     *\n     * @param proxy the string to use, in the form \"host:port\"\n     * @return a proxy or null\n     */\n    @SuppressForbidden(reason = \"Proxy constructor requires a SocketAddress\")\n    static Proxy buildProxy(String proxy) throws UserException {\n        if (proxy == null) {\n            return null;\n        }\n\n        final String[] parts = proxy.split(\":\");\n        if (parts.length != 2) {\n            throw new UserException(ExitCodes.CONFIG, \"Malformed [proxy], expected [host:port]\");\n        }\n\n        if (validateProxy(parts[0], parts[1]) == false) {\n            throw new UserException(ExitCodes.CONFIG, \"Malformed [proxy], expected [host:port]\");\n        }\n\n        return new Proxy(Proxy.Type.HTTP, new InetSocketAddress(parts[0], Integer.parseUnsignedInt(parts[1])));\n    }\n\n    /**\n     * Check that the hostname is not empty, and that the port is numeric.\n     *\n     * @param hostname the hostname to check. Besides ensuring it is not null or empty, no further validation is\n     *                 performed.\n     * @param port the port to check. Must be composed solely of digits.\n     * @return whether the arguments describe a potentially valid proxy.\n     */\n    static boolean validateProxy(String hostname, String port) {","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/distribution/tools/plugin-cli/src/main/java/org/elasticsearch/plugins/cli/ProxyUtils.java#L21-L57","documentation":"First of two identical-throws in ProxyUtils.buildProxy: when a non-null proxy string does not split into exactly two `:`-separated parts. buildProxy is the runtime constructor used by install/sync flows (distinct from PluginsConfig.validate, which mirrors the same rule). Exit code is CONFIG (78) via UserException.","triggerScenarios":"buildProxy receives a non-null proxy string, splits on `:`, and throws UserException(CONFIG) when parts.length != 2. Reached when the CLI --proxy flag or another caller passes a malformed proxy to buildProxy rather than going through PluginsConfig validation first.","commonSituations":"User passes `--proxy host` (no port) or `--proxy http://host:port` (scheme adds colons); environment variable with a bare host; IPv6 host written without brackets.","solutions":["Pass the proxy as `host:port` only, e.g. `--proxy proxy.internal:8080`.","For IPv6, use bracketed form: `[::1]:8080`.","Strip any `http://`/`https://` scheme — buildProxy adds Proxy.Type.HTTP itself."],"exampleFix":"# before:\nbin/elasticsearch-plugin install x --proxy http://proxy:8080\n# after:\nbin/elasticsearch-plugin install x --proxy proxy:8080","handlingStrategy":"validation","validationCode":"// Validate --proxy shape before calling buildProxy.\nif (proxy != null && proxy.split(\":\").length != 2) {\n    throw new IllegalArgumentException(\"--proxy must be host:port\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    Proxy p = ProxyUtils.buildProxy(proxyArg);\n} catch (UserException e) {\n    if (e.exitCode == ExitCodes.CONFIG) {\n        // surface a friendly error to the operator\n        System.err.println(\"Invalid proxy format. Use host:port (e.g. proxy.internal:8080).\");\n    }\n    throw e;\n}","preventionTips":["Pass `host:port` only — no scheme, no brackets (except IPv6).","Source the proxy from a structured config (host + port fields) joined at the call site.","Document the expected format next to every --proxy flag in your runbooks."],"tags":["proxy","validation","plugin-cli","configuration"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}