{"record":{"id":"e007454ead9ff54f","repo":"HKUDS/nanobot","slug":"invalid-trusted-proxy-cidr-value-r","errorCode":null,"errorMessage":"invalid trusted proxy CIDR: {value!r}","messagePattern":"invalid trusted proxy CIDR: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"nanobot/channels/websocket/runtime.py","lineNumber":145,"sourceCode":"class TrustedProxyAuthConfig(Base):\n    \"\"\"Authentication assertions accepted from explicitly trusted proxy peers.\"\"\"\n\n    trusted_peer_cidrs: list[str] = Field(min_length=1)\n    assertion_header: str = Field(min_length=1)\n    _trusted_peer_networks: tuple[ipaddress.IPv4Network | ipaddress.IPv6Network, ...] = PrivateAttr(\n        default=()\n    )\n\n    @field_validator(\"trusted_peer_cidrs\")\n    @classmethod\n    def validate_trusted_peer_cidrs(cls, values: list[str]) -> list[str]:\n        normalized: list[str] = []\n        for value in values:\n            value = value.strip()\n            try:\n                network = ipaddress.ip_network(value, strict=False)\n            except ValueError as exc:\n                raise ValueError(f\"invalid trusted proxy CIDR: {value!r}\") from exc\n            if network.prefixlen == 0:\n                raise ValueError(\"universal trusted proxy CIDRs are not allowed\")\n            if isinstance(network, ipaddress.IPv6Network):\n                mapped_start = ipaddress.IPv6Address(\"::ffff:0:0\")\n                mapped_end = ipaddress.IPv6Address(\"::ffff:ffff:ffff\")\n                if mapped_start in network and mapped_end in network:\n                    raise ValueError(\"trusted proxy CIDRs must not cover all IPv4-mapped addresses\")\n            normalized.append(network.with_prefixlen)\n        return normalized\n\n    @field_validator(\"assertion_header\")\n    @classmethod\n    def validate_assertion_header(cls, value: str) -> str:\n        value = value.strip()\n        if not value or any(char.isspace() or ord(char) < 0x21 for char in value):\n            raise ValueError(\"assertion_header must be a valid HTTP header name\")\n        if _is_routing_assertion_header(value):\n            raise ValueError(","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/HKUDS/nanobot/blob/42f37dc4c0e409eac7818a82d165c5f2757bc075/nanobot/channels/websocket/runtime.py#L127-L163","documentation":"Error \"invalid trusted proxy CIDR: {value!r}\" thrown in HKUDS/nanobot.","triggerScenarios":"Thrown at nanobot/channels/websocket/runtime.py:145 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"42f37dc4c0e409eac7818a82d165c5f2757bc075","analyzedAt":"2026-08-26T00:18:52.276Z","schemaVersion":2},"datasetVersion":"2026-08-26T04:18:47.238Z"}