{"record":{"id":"ac5e476aed7de0fc","repo":"crowdsecurity/crowdsec","slug":"invalid-ip-range-s-w","errorCode":null,"errorMessage":"invalid ip range '%s': %w","messagePattern":"invalid ip range '(.+?)': %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/types/ip.go","lineNumber":41,"sourceCode":"\t\t\tip[9] | ^n.Mask[9], ip[10] | ^n.Mask[10], ip[11] | ^n.Mask[11],\n\t\t\tip[12] | ^n.Mask[12], ip[13] | ^n.Mask[13], ip[14] | ^n.Mask[14],\n\t\t\tip[15] | ^n.Mask[15],\n\t\t}\n\t}\n\n\treturn net.IPv4(\n\t\tip[0]|^n.Mask[0],\n\t\tip[1]|^n.Mask[1],\n\t\tip[2]|^n.Mask[2],\n\t\tip[3]|^n.Mask[3])\n}\n\n/*returns a range for any ip or range*/\nfunc Addr2Ints(anyIP string) (int, int64, int64, int64, int64, error) {\n\tif strings.Contains(anyIP, \"/\") {\n\t\t_, net, err := net.ParseCIDR(anyIP)\n\t\tif err != nil {\n\t\t\treturn -1, 0, 0, 0, 0, fmt.Errorf(\"invalid ip range '%s': %w\", anyIP, err)\n\t\t}\n\n\t\treturn Range2Ints(*net)\n\t}\n\n\tip := net.ParseIP(anyIP)\n\tif ip == nil {\n\t\treturn -1, 0, 0, 0, 0, fmt.Errorf(\"invalid ip address '%s'\", anyIP)\n\t}\n\n\tsz, start, end, err := IP2Ints(ip)\n\tif err != nil {\n\t\treturn -1, 0, 0, 0, 0, fmt.Errorf(\"invalid ip address '%s': %w\", anyIP, err)\n\t}\n\n\treturn sz, start, end, start, end, nil\n}\n","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/types/ip.go#L23-L59","documentation":"Addr2Ints converts any IP or CIDR string into integer range bounds. When the string contains '/', it is parsed with net.ParseCIDR; failure produces \"invalid ip range '%s'\" wrapping the net error. Callers such as NewRange (used by bouncers/alert range handling) rely on this to reject malformed network specifications.","triggerScenarios":"Calling Addr2Ints (directly or via NewRange/TestAdd2Int) with a slash-containing string that is not valid CIDR, e.g. '10.0.0/24', '10.0.0.0/33', '10.0.0.0/ 24'.","commonSituations":"Machines/bouncers posting alerts with a malformed range field; parsing untrusted user input as a range; config value with a typo in the CIDR; missing octet in an address.","solutions":["Validate the string with net.ParseCIDR or `ipaddress.ip_network(...)` before passing it in","Correct the CIDR: full address, valid octets, prefix 0–32/0–128, no spaces","If the input may be a bare IP without mask, ensure it does not contain '/' or normalize it first","Inspect the wrapped net error to see exactly which character/field failed"],"exampleFix":"// before\nr, err := types.NewRange(\"192.168.1/24\")\n// after\nr, err := types.NewRange(\"192.168.1.0/24\")","handlingStrategy":"validation","validationCode":"import \"net\"\nfunc validCIDR(s string) bool {\n  _, _, err := net.ParseCIDR(s)\n  return err == nil\n}","typeGuard":"func isCIDRString(s string) bool {\n  return strings.Contains(s, \"/\") && net.ParseCIDR(s) != nil\n}","tryCatchPattern":"r, err := types.NewRange(input)\nif err != nil {\n  if strings.Contains(err.Error(), \"invalid ip range\") {\n    return fmt.Errorf(\"rejecting malformed range %q: %v\", input, err)\n  }\n  return err\n}","preventionTips":["Validate all external CIDR input with net.ParseCIDR before conversion","Normalize user input (trim spaces, require full address + prefix)","Unit-test range parsing with malformed fixtures"],"tags":["go","network","cidr","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}