{"record":{"id":"b0e099e7156abcd6","repo":"SonarSource/sonarqube","slug":"s-b0e099","errorCode":null,"errorMessage":"%s","messagePattern":"%s","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/webhook/ws/WebhookSupport.java","lineNumber":61,"sourceCode":"  public WebhookSupport(UserSession userSession, Configuration configuration, NetworkInterfaceProvider networkInterfaceProvider) {\n    this.userSession = userSession;\n    this.configuration = configuration;\n    this.networkInterfaceProvider = networkInterfaceProvider;\n  }\n\n  void checkPermission(ProjectDto projectDto) {\n    userSession.checkEntityPermission(ProjectPermission.ADMIN, projectDto);\n  }\n\n  void checkPermission() {\n    userSession.checkPermission(GlobalPermission.ADMINISTER);\n  }\n\n  void checkUrlPattern(String url, String message, Object... messageArguments) {\n    try {\n      HttpUrl okUrl = HttpUrl.parse(url);\n      if (okUrl == null) {\n        throw new IllegalArgumentException(String.format(message, messageArguments));\n      }\n      InetAddress address = InetAddress.getByName(okUrl.host());\n\n      if (configuration.getBoolean(SONAR_VALIDATE_WEBHOOKS_PROPERTY)\n        .orElse(SONAR_VALIDATE_WEBHOOKS_DEFAULT_VALUE)\n        && WebhookAddressValidator.isBlockedAddress(address, networkInterfaceProvider)) {\n        throw new IllegalArgumentException(WebhookAddressValidator.INVALID_ADDRESS_MESSAGE);\n      }\n    } catch (UnknownHostException e) {\n      // if a host can not be resolved the deliveries will fail - no need to block it from being set\n      // this will only happen for public URLs\n    } catch (SocketException e) {\n      throw new IllegalStateException(\"Can not retrieve a network interfaces\", e);\n    }\n  }\n}\n","sourceCodeStart":43,"sourceCodeEnd":78,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/webhook/ws/WebhookSupport.java#L43-L78","documentation":"Thrown by WebhookSupport.checkUrlPattern when the webhook URL cannot be parsed by OkHttp's HttpUrl, causing the caller-supplied message (with its format arguments) to be wrapped in an IllegalArgumentException. This is the generic 'your webhook URL string is malformed' failure raised by api/webhooks/create and api/webhooks/update.","triggerScenarios":"POST api/webhooks/create or update with a 'url' parameter that is not a valid absolute HTTP(S) URL, e.g. missing scheme, containing spaces or invalid characters, or being an empty/garbage string; the format message then describes the invalid URL.","commonSituations":"Environment variable holding the URL left empty or containing trailing whitespace/newline; URL quoted incorrectly in shell scripts; forgetting 'https://'; template placeholders like ${WEBHOOK_URL} not substituted by the templating engine.","solutions":["Ensure the URL is a valid absolute http(s) URL including scheme, e.g. https://hooks.example.com/sonarqube.","Echo/inspect the value actually passed (env vars, CI secrets) to catch empty or unsubstituted placeholders.","Trim whitespace and re-run the request."],"exampleFix":"// before\ncurl -u $TOKEN -X POST \"$SONAR/api/webhooks/create?name=ci&url=$WEBHOOK_URL\" // WEBHOOK_URL empty -> parse fails\n// after\n: \"${WEBHOOK_URL:?must be a valid https URL}\"\ncurl -u $TOKEN -X POST \"$SONAR/api/webhooks/create?name=ci&url=$WEBHOOK_URL\"","handlingStrategy":"validation","validationCode":"boolean isValidWebhookUrl(String url) {\n  try {\n    java.net.URI u = java.net.URI.create(url.trim());\n    return (u.getScheme().equals(\"http\") || u.getScheme().equals(\"https\")) && u.getHost() != null;\n  } catch (Exception | NullPointerException e) {\n    return false;\n  }\n}","typeGuard":"boolean isNonEmptyHttpUrl(Object v) {\n  return v instanceof String s && !s.isBlank() && (s.startsWith(\"http://\") || s.startsWith(\"https://\"));\n}","tryCatchPattern":"try {\n  createWebhook(name, url);\n} catch (IllegalArgumentException e) {\n  throw new ConfigurationException(\"Webhook URL is not a valid absolute http(s) URL: \" + url, e);\n}","preventionTips":["Validate webhook URLs (scheme + host) in config before deploying.","Use ${VAR:?} shell guards to fail fast on empty env vars.","Beware templating engines leaving ${PLACEHOLDER} unsubstituted in URLs."],"tags":["webhook","url","validation","web-api"],"backgroundTag":"invalid-url","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}