{"record":{"id":"c3bf6aa6c42d4768","repo":"larksuite/cli","slug":"invalid-proxy-address-q-w","errorCode":null,"errorMessage":"invalid proxy address %q: %w","messagePattern":"invalid proxy address %q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sidecar/protocol.go","lineNumber":160,"sourceCode":"\n\t// Bare host:port (no scheme) — validate as a net address.\n\tif !strings.Contains(addr, \"://\") {\n\t\thost, port, err := net.SplitHostPort(addr)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid proxy address %q: expected host:port or http://host:port\", addr)\n\t\t}\n\t\tif host == \"\" || port == \"\" {\n\t\t\treturn fmt.Errorf(\"invalid proxy address %q: host and port must not be empty\", addr)\n\t\t}\n\t\tif !isSameHost(host) {\n\t\t\treturn errNotSameHost(addr)\n\t\t}\n\t\treturn nil\n\t}\n\n\tu, err := url.Parse(addr)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: %w\", addr, err)\n\t}\n\tif u.User != nil {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: userinfo is not allowed\", addr)\n\t}\n\tif u.Scheme == \"https\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: use http:// — sidecar is \"+\n\t\t\t\"same-host only (loopback or virtual same-host bridge), so TLS adds \"+\n\t\t\t\"no security; cross-machine deployment is out of scope\", addr)\n\t}\n\tif u.Scheme != \"http\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: scheme must be http\", addr)\n\t}\n\tif u.Host == \"\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: missing host\", addr)\n\t}\n\tif u.Path != \"\" && u.Path != \"/\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: path is not allowed\", addr)\n\t}","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/sidecar/protocol.go#L142-L178","documentation":"For a scheme-bearing LARKSUITE_CLI_AUTH_PROXY value, ValidateProxyAddr parses it with url.Parse; if parsing fails, the underlying url.Error is wrapped into this error. The string could not be interpreted as a URL at all.","triggerScenarios":"Calling ValidateProxyAddr with a '://'-containing value that url.Parse rejects — e.g. \"http://[::1:16384\" (malformed IPv6 bracket), \"http://host:port\" where port is non-numeric (url.Parse tolerates many things but net checks elsewhere), control characters or spaces in the URL, \"http://exa mple:16384\".","commonSituations":"Unbalanced brackets around IPv6 addresses; spaces from copy/paste; newline or tab contamination in env values from config templates; stray characters like backslashes.","solutions":["Use a clean canonical address: `export LARKSUITE_CLI_AUTH_PROXY=\"http://127.0.0.1:16384\"`.","For IPv6, balance the brackets: `http://[::1]:16384`.","Strip spaces/newlines/control characters (`echo \"$LARKSUITE_CLI_AUTH_PROXY\" | cat -A` to inspect).","If the value was templated, re-render the template and verify the substituted value."],"exampleFix":"// before\nexport LARKSUITE_CLI_AUTH_PROXY=\"http://[::1:16384\"\n// after\nexport LARKSUITE_CLI_AUTH_PROXY=\"http://[::1]:16384\"","handlingStrategy":"validation","validationCode":"u, err := url.Parse(addr) // for :// values\nif err != nil {\n\treturn fmt.Errorf(\"proxy URL %q unparseable: %w\", addr, err)\n}","typeGuard":null,"tryCatchPattern":"var urlErr *url.Error\nif err := sidecar.ValidateProxyAddr(addr); err != nil {\n\tif errors.As(err, &urlErr) || strings.Contains(err.Error(), \"invalid proxy address\") {\n\t\treturn fmt.Errorf(\"fix LARKSUITE_CLI_AUTH_PROXY syntax (example: http://127.0.0.1:16384): %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Use the canonical form http://127.0.0.1:16384 — no exotic characters.","Balance IPv6 brackets exactly once.","Sanitize env values from templating/CI (strip spaces, newlines, control chars).","Validate at process startup with sidecar.ValidateProxyAddr."],"tags":["configuration","url-parsing","proxy-address","sidecar"],"backgroundTag":"invalid-proxy-address","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}