{"record":{"id":"d20aff6ce11eda08","repo":"apache/druid","slug":"subnet-arg-has-an-invalid-format-s","errorCode":null,"errorMessage":"subnet arg has an invalid format: %s","messagePattern":"subnet arg has an invalid format: (.+?)","errorType":"validation","errorClass":"DruidException","httpStatus":null,"severity":"error","filePath":"processing/src/main/java/org/apache/druid/query/expression/IPv4AddressMatchExprMacro.java","lineNumber":140,"sourceCode":"        }\n      }\n\n      return new IPv4AddressMatchExpr(args);\n    }\n\n    catch (AddressStringException e) {\n      throw processingFailed(e, \"failed to parse address\");\n    }\n  }\n\n  private IPAddressString getSubnetInfo(List<Expr> args)\n  {\n    String subnetArgName = \"subnet\";\n    Expr arg = args.get(ARG_SUBNET);\n    validationHelperCheckArgIsLiteral(arg, subnetArgName);\n    String subnet = (String) arg.getLiteralValue();\n    if (!IPv4AddressExprUtils.isValidIPv4Subnet(subnet)) {\n      throw validationFailed(subnetArgName + \" arg has an invalid format: \" + subnet);\n    }\n    return new IPAddressString(subnet);\n  }\n}\n","sourceCodeStart":122,"sourceCodeEnd":145,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/processing/src/main/java/org/apache/druid/query/expression/IPv4AddressMatchExprMacro.java#L122-L145","documentation":"IPV4_MATCH's subnet argument must be a string literal in valid IPv4 CIDR form (e.g. 10.0.0.0/8). getSubnetInfo checks the literal with IPv4AddressExprUtils.isValidIPv4Subnet and throws a validation failure when it does not parse, so an invalid subnet never reaches the matcher.","triggerScenarios":"Calling IPV4_MATCH(addr, '<subnet>') where the second argument is a literal that fails isValidIPv4Subnet: missing '/prefix', prefix out of 0-32, non-numeric octets, an IPv6 subnet, or an empty string.","commonSituations":"Typos like '10.0.0.0/08' or '192.168.1/24'; passing a bare address '10.0.0.1' with no /prefix when a subnet is required; quoting errors that make the subnet an empty or concatenated string.","solutions":["Use proper CIDR notation with an explicit prefix: IPV4_MATCH(addr, '10.0.0.0/8').","Verify the prefix length is a decimal number between 0 and 32 with no leading zeros or stray characters.","Confirm the argument is a string literal; if it comes from a variable, validate it with IPv4AddressExprUtils.isValidIPv4Subnet before substitution."],"exampleFix":"-- before\nSELECT IPV4_MATCH(ip, '10.0.0.0') FROM t\n-- after\nSELECT IPV4_MATCH(ip, '10.0.0.0/8') FROM t","handlingStrategy":"validation","validationCode":"// Java\nif (!IPv4AddressExprUtils.isValidIPv4Subnet(subnet)) { throw new IllegalArgumentException(\"subnet must be valid IPv4 CIDR: \" + subnet); }","typeGuard":"static boolean isValidIpv4Cidr(String s) {\n  return s != null && s.matches(\"^(\\\\d{1,3}\\\\.){3}\\\\d{1,3}/(\\\\d{1,2})$\") && validPrefix(s);\n}","tryCatchPattern":"try {\n  return runDruidQuery(query);\n} catch (ExpressionValidationException e) {\n  if (e.getMessage().contains(\"invalid format\")) {\n    throw new UserInputException(\"IPV4_MATCH subnet must be CIDR like 10.0.0.0/8\");\n  }\n  throw e;\n}","preventionTips":["Always include an explicit /prefix in IPV4_MATCH subnets.","Keep subnet configuration in validated config files, not free-text input.","Unit-test generated subnets with isValidIPv4Subnet before shipping queries."],"tags":["druid","expression","ipv4","cidr","validation"],"backgroundTag":"invalid-argument-format","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}