{"record":{"id":"b959767f302b1770","repo":"iflytek/astron-agent","slug":"invalid-setting-name-entry","errorCode":null,"errorMessage":"Invalid {setting_name} entry","messagePattern":"Invalid (.+?) entry","errorType":"validation","errorClass":"OutboundPolicyError","httpStatus":null,"severity":"error","filePath":"core/plugin/link/infra/tool_exector/ssrf_guard.py","lineNumber":224,"sourceCode":"        raise OutboundPolicyError(\"Outbound URL must not include user information\")\n    if \"\\\\\" in parsed.netloc:\n        raise OutboundPolicyError(\"Outbound URL authority is invalid\")\n    if parsed.fragment:\n        raise OutboundPolicyError(\"Outbound URL must not include a fragment\")\n    if port is not None and not 1 <= port <= 65535:\n        raise OutboundPolicyError(\"Outbound URL port is invalid\")\n\n\ndef _parse_networks(raw_value: str, setting_name: str) -> Tuple[IpNetwork, ...]:\n    networks = []\n    for entry in raw_value.split(\",\"):\n        value = entry.strip()\n        if not value:\n            continue\n        try:\n            networks.append(ipaddress.ip_network(value, strict=False))\n        except ValueError as exc:\n            raise OutboundPolicyError(f\"Invalid {setting_name} entry\") from exc\n    return tuple(networks)\n\n\ndef _parse_domains(raw_value: str) -> Tuple[str, ...]:\n    domains = []\n    for entry in raw_value.split(\",\"):\n        value = entry.strip().lower().rstrip(\".\")\n        if value.startswith(\"*.\"):\n            value = value[2:]\n        if value.startswith(\".\"):\n            value = value[1:]\n        if not value:\n            continue\n        if \"://\" in value or \"/\" in value:\n            raise OutboundPolicyError(\"Invalid DOMAIN_BLACK_LIST entry\")\n        try:\n            # Use the same IDNA normalization as aiohttp/yarl applies to request hosts.\n            # Python's built-in ``idna`` codec follows IDNA2003 and would otherwise","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/plugin/link/infra/tool_exector/ssrf_guard.py#L206-L242","documentation":"When loading the SSRF policy from environment (from_environment), IP/CIDR network lists are parsed with ipaddress.ip_network. Any comma-separated entry that is not a valid IP address or CIDR network raises OutboundPolicyError naming the offending setting (the message interpolates setting_name, e.g. 'Invalid IP_WHITE_LIST entry').","triggerScenarios":"from_environment reads an env var whose comma-split entry fails ip_network(strict=False): a domain name (example.com) in an IP list, a hyphen range (10.0.0.1-10.0.0.5), a truncated address (10.0.0), a host:port token, or stray non-CIDR text.","commonSituations":"Ops pasting domain names into an IP allowlist; using Nginx-style ranges instead of CIDR; missing prefix like 10.0.0.0/8 written as 10.0.0.0; whitespace/typo corruption in deployed env files.","solutions":["Convert each entry to a valid CIDR: use 10.0.0.0/24 form; a single IP like 10.0.0.1 is accepted as /32.","Replace hyphen ranges with CIDR equivalents (10.0.0.1-10.0.0.5 → 10.0.0.0/29-style covering block, or list each IP).","Verify each entry with python -c \"import ipaddress; ipaddress.ip_network('ENTRY', strict=False)\" before deploying.","Domains belong in DOMAIN_BLACK_LIST, not the IP list — move them to the correct setting."],"exampleFix":"// before\nIP_WHITE_LIST=example.com,10.0.0.1-10.0.0.5\n// after\nIP_WHITE_LIST=10.0.0.1/32,10.0.0.2/31,10.0.0.4/31\nDOMAIN_BLACK_LIST=example.com","handlingStrategy":"validation","validationCode":"import ipaddress\ndef valid_cidr_list(raw: str) -> bool:\n    for entry in raw.split(\",\"):\n        v = entry.strip()\n        if not v:\n            continue\n        try:\n            ipaddress.ip_network(v, strict=False)\n        except ValueError:\n            return False\n    return True","typeGuard":null,"tryCatchPattern":"try:\n    policy = OutboundPolicy.from_environment()\nexcept OutboundPolicyError as e:\n    raise ConfigError(f\"bad SSRF policy env: {e}\") from e","preventionTips":["Use CIDR notation (10.0.0.0/24); single IPs are fine as /32","Never put domains in IP lists — use DOMAIN_BLACK_LIST","Test env values with ipaddress.ip_network(entry, strict=False) in CI before deploy"],"tags":["security","ssrf","env-config","cidr"],"backgroundTag":"invalid-env-var-value","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-19T12:17:13.211Z"}