{"record":{"id":"9dbfff64e3f11952","repo":"apache/cassandra","slug":"invalid-ip-s","errorCode":null,"errorMessage":"Invalid IP %s","messagePattern":"Invalid IP (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/CIDRGroupsMappingManager.java","lineNumber":235,"sourceCode":"            existingMappings.remove(cidrGroupName);\n        }\n\n        // Delete old CIDR groups which do not exist in new mappings\n        for (String cidrGroupName : existingMappings)\n        {\n            dropCidrGroupIfExists(cidrGroupName);\n        }\n    }\n\n    public Set<String> getCidrGroupsOfIP(String ipStr)\n    {\n        try\n        {\n            return DatabaseDescriptor.getCIDRAuthorizer().lookupCidrGroupsForIp(InetAddress.getByName(ipStr));\n        }\n        catch (UnknownHostException e)\n        {\n            throw new IllegalArgumentException(\"Invalid IP \" + ipStr, e);\n        }\n    }\n\n    public void loadCidrGroupsCache()\n    {\n        DatabaseDescriptor.getCIDRAuthorizer().loadCidrGroupsCache();\n    }\n}\n","sourceCodeStart":217,"sourceCodeEnd":244,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/CIDRGroupsMappingManager.java#L217-L244","documentation":"CIDRGroupsMappingManager.getCidrGroupsOfIP resolves the given IP string via InetAddress.getByName; if the string is not a valid IP literal and cannot be resolved as a host name, UnknownHostException is caught and rethrown as IllegalArgumentException(\"Invalid IP <ip>\"). This guards lookups into the CIDR authorizer's group mapping.","triggerScenarios":"Calling getCidrGroupsOfIP (e.g. via CIDR-related tooling or CQLSH cidr commands) with a malformed string like '999.1.2.3', 'not-an-ip', or an unresolvable hostname.","commonSituations":"Copy-pasting IPv6 addresses with typos; passing hostnames in environments without DNS; feeding user-supplied IP strings without validation into CIDR group lookups.","solutions":["Pass a syntactically valid IP literal (IPv4 or IPv6), e.g. validate with InetAddress.getByName or a regex before the call.","If a hostname is intended, ensure DNS resolution works or resolve it to an IP first.","Catch IllegalArgumentException and surface a clear validation message to the user."],"exampleFix":"// before\nmanager.getCidrGroupsOfIP(userInput); // may throw for malformed input\n// after\nInetAddress addr = InetAddress.getByName(userInput); // validate/format first\nmanager.getCidrGroupsOfIP(addr.getHostAddress());\n","handlingStrategy":"validation","validationCode":"boolean isValidIp(String s) {\n    try { InetAddress.getByName(s); return true; } catch (UnknownHostException e) { return false; }\n}\n// call only if isValidIp(ip)","typeGuard":"boolean isIpLiteral(String s) {\n    return s != null && (s.matches(\"^(\\\\d{1,3}\\\\.){3}\\\\d{1,3}$\") || s.contains(\":\"));\n}","tryCatchPattern":"try { groups = manager.getCidrGroupsOfIP(ip); } catch (IllegalArgumentException e) { log.warn(\"Skipping CIDR lookup: \" + e.getMessage()); }","preventionTips":["Validate IP strings before passing them to CIDR lookups.","Use InetAddress utilities or a CIDR library to parse and normalize addresses.","Avoid accepting hostnames where IP literals are expected, or resolve them explicitly."],"tags":["auth","cidr","ip-address","invalid-argument"],"backgroundTag":"invalid-argument-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}