{"record":{"id":"956db8d65e9a91a3","repo":"weaviate/weaviate","slug":"invalid-baseurl-w","errorCode":null,"errorMessage":"invalid baseURL: %w","messagePattern":"invalid baseURL: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"usecases/modulecomponents/validate_baseurl.go","lineNumber":77,"sourceCode":"\t\tip.IsPrivate() ||\n\t\tip.IsLinkLocalUnicast() ||\n\t\tip.IsLinkLocalMulticast() ||\n\t\tip.IsUnspecified()\n}\n\n// ValidateBaseURL validates a module baseURL (class config or X-*-Baseurl\n// header) against SSRF abuse: https-only, non-empty host, and not pointing at\n// an internal address (by IP literal, by blocked hostname/suffix, or by DNS\n// resolution). It is a no-op unless MODULES_VALIDATE_BASE_URL is enabled; an\n// empty baseURL means \"use the module default\" and is allowed.\nfunc ValidateBaseURL(baseURL string) error {\n\tif !BaseURLValidationEnabled() || baseURL == \"\" {\n\t\treturn nil\n\t}\n\n\tparsed, err := url.Parse(baseURL)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid baseURL: %w\", err)\n\t}\n\tif parsed.Scheme != \"https\" {\n\t\treturn fmt.Errorf(\"baseURL must use HTTPS\")\n\t}\n\thost := parsed.Hostname()\n\tif host == \"\" {\n\t\treturn fmt.Errorf(\"baseURL must have a non-empty host\")\n\t}\n\n\tif ip := net.ParseIP(host); ip != nil {\n\t\tif isDisallowedIP(ip) {\n\t\t\treturn fmt.Errorf(\"baseURL cannot target internal addresses\")\n\t\t}\n\t\treturn nil\n\t}\n\n\tlower := strings.ToLower(host)\n\tfor _, blocked := range blockedHostnames {","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/usecases/modulecomponents/validate_baseurl.go#L59-L95","documentation":"ValidateBaseURL (when BaseURLValidationEnabled) parses a module baseURL with url.Parse to enforce SSRF/HTTPS safety rules. If the string cannot be parsed as a URL at all (malformed scheme/percent-encoding/control characters), the function returns this wrapped error.","triggerScenarios":"Configuring a module (e.g. text2vec-openai, generative modules) with BASE_URL containing characters that make url.Parse fail — raw spaces, unescaped '%' (e.g. \"https://api.example.com/%zz\"), or embedded control characters.","commonSituations":"Copy-pasting a URL with a trailing space/newline from documentation; hand-encoding query strings with stray '%'; templating tools injecting whitespace.","solutions":["Fix the BASE_URL to a well-formed absolute URL, e.g. https://api.example.com.","Trim whitespace/newlines from the env value; percent-encode special characters properly (%25 for a literal %).","Validate locally with a quick script: python3 -c \"import urllib.parse; urllib.parse.urlparse('YOUR_URL')\" or a Go url.Parse test before deploying.","If you control policy, note validation can be disabled via the BaseURLValidation toggle, but fixing the URL is the correct fix."],"exampleFix":"// before\nBASE_URL=https://api.example.com/v1 %\n// after\nBASE_URL=https://api.example.com/v1","handlingStrategy":"validation","validationCode":"// Validate the module base URL before startup\nu := os.Getenv(\"BASE_URL\")\nif _, err := url.Parse(strings.TrimSpace(u)); err != nil {\n    panic(fmt.Sprintf(\"BASE_URL is not a parseable URL: %v\", err))\n}","typeGuard":"func isParseableURL(s string) bool {\n    _, err := url.Parse(strings.TrimSpace(s))\n    return err == nil\n}","tryCatchPattern":"if err := modulecomponents.ValidateBaseURL(baseURL); err != nil {\n    return fmt.Errorf(\"rejecting module config, fix BASE_URL (well-formed absolute URL): %w\", err)\n}","preventionTips":["Trim whitespace/newlines from URL env values.","Percent-encode literal '%' as %25 in paths.","Test the URL with url.Parse or any URL validator before deploying."],"tags":["weaviate","modules","url-validation","ssrf","configuration"],"backgroundTag":"invalid-baseurl","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}