{"record":{"id":"dd9033fb37fcec94","repo":"jeecgboot/JeecgBoot","slug":"url-dd9033","errorCode":null,"errorMessage":"非法URL：主机名无法解析","messagePattern":"非法URL：主机名无法解析","errorType":"validation","errorClass":"JeecgBootException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/filter/SsrfFileTypeFilter.java","lineNumber":351,"sourceCode":"        if (scheme == null || !(scheme.equalsIgnoreCase(\"http\") || scheme.equalsIgnoreCase(\"https\"))) {\n            throw new JeecgBootException(\"非法URL：仅允许 http / https 协议\");\n        }\n        String host = uri.getHost();\n        if (StringUtils.isBlank(host)) {\n            throw new JeecgBootException(\"非法URL：主机名为空\");\n        }\n        // 去掉 IPv6 的中括号\n        if (host.startsWith(\"[\") && host.endsWith(\"]\")) {\n            host = host.substring(1, host.length() - 1);\n        }\n        try {\n            for (InetAddress addr : InetAddress.getAllByName(host)) {\n                if (addr.isLoopbackAddress() || addr.isLinkLocalAddress()) {\n                    throw new JeecgBootException(\"非法URL：禁止访问本机或链路本地地址 \" + addr.getHostAddress());\n                }\n            }\n        } catch (UnknownHostException e) {\n            throw new JeecgBootException(\"非法URL：主机名无法解析\");\n        }\n    }\n    //update-end---author:zhangdaihao ---date:2026-04-15  for：【issues/9553】修复二次SSRF漏洞，对HTTP下载URL进行安全校验-----------\n\n    /**\n     * 批量校验文件路径安全性（逗号分隔的多个文件路径）\n     * @param files 逗号分隔的文件路径\n     */\n    public static void checkPathTraversalBatch(String files) {\n        if (StringUtils.isBlank(files)) {\n            return;\n        }\n        for (String file : files.split(\",\")) {\n            if (StringUtils.isNotBlank(file)) {\n                checkPathTraversal(file.trim());\n            }\n        }\n    }","sourceCodeStart":333,"sourceCodeEnd":369,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/filter/SsrfFileTypeFilter.java#L333-L369","documentation":"Thrown by checkSsrfHttpUrl when InetAddress.getAllByName(host) throws UnknownHostException — the hostname cannot be resolved via DNS. This is a network-level failure: either the domain does not exist, DNS is unreachable, or the hostname has a typo. The method wraps the original UnknownHostException into a JeecgBootException with a clear message.","triggerScenarios":"Hostname has a typo (e.g., 'exmaple.com'), domain does not exist, DNS server is down, the server has no network access, or the hostname is a non-routable internal name not registered in DNS.","commonSituations":"Air-gapped or restricted network environment where external DNS is blocked; typo in a configured MinIO/OSS endpoint; service DNS name changed after migration; containerized environment missing DNS configuration.","solutions":["Verify the hostname is correct and resolvable from the application server (test with 'nslookup' or 'dig' on the server).","If using internal hostnames, ensure DNS or /etc/hosts is configured on the application server.","Check network policies/firewall rules that may block DNS (port 53).","In containerized deployments, verify Docker/Kubernetes DNS service is running and the hostname matches the service discovery name."],"exampleFix":"// No code fix — verify DNS resolution from the server host.\n// Debug command:\n//   nslookup <hostname-from-error>\n// If DNS is unavailable, add a static hosts entry:\n//   echo \"10.0.0.5 minio.internal\" >> /etc/hosts","handlingStrategy":"try-catch","validationCode":"try {\n    InetAddress.getAllByName(hostFromUrl);\n} catch (UnknownHostException e) {\n    return Result.error(\"主机名无法解析，请检查网络或DNS配置: \" + hostFromUrl);\n}","typeGuard":null,"tryCatchPattern":"try {\n    SsrfFileTypeFilter.checkSsrfHttpUrl(fileUrl);\n} catch (JeecgBootException e) {\n    if (e.getMessage().contains(\"无法解析\")) {\n        log.warn(\"DNS resolution failed for URL host: {}\", fileUrl);\n    }\n    return Result.error(e.getMessage());\n}","preventionTips":["Verify DNS resolution from the application server before deploying.","Configure /etc/hosts or internal DNS for non-public hostnames.","In containerized environments, verify DNS service is operational."],"tags":["ssrf","dns","network","hostname","security"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}