{"record":{"id":"e985b6e668650d64","repo":"larksuite/cli","slug":"invalid-s-q-fragment-is-not-allowed","errorCode":null,"errorMessage":"invalid %s %q: fragment is not allowed","messagePattern":"invalid (.+?) %q: fragment is not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/transport/config.go","lineNumber":221,"sourceCode":"\tif u.Host == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: missing host\", envvars.CliProxyAddress, redacted)\n\t}\n\t// Security hardening: only allow a loopback proxy. This prevents accidental\n\t// cross-machine proxying of credentials/traffic.\n\tif u.Hostname() != \"127.0.0.1\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: host must be 127.0.0.1\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Port() == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: explicit port is required\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Path != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: path is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.RawQuery != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: query is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Fragment != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: fragment is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\treturn u, nil\n}\n\n// ApplyToTransport clones base and applies proxy plugin settings to the clone.\n// Caller owns the returned *http.Transport.\nfunc (c *Config) ApplyToTransport(base *http.Transport) (*http.Transport, error) {\n\tif base == nil {\n\t\tbase = http.DefaultTransport.(*http.Transport)\n\t}\n\tu, err := c.proxyURL()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tt := base.Clone()\n\tt.Proxy = http.ProxyURL(u) // fixed proxy overrides environment proxy vars\n\tif err := applyExtraRootCA(t, c.CAPath); err != nil {","sourceCodeStart":203,"sourceCodeEnd":239,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/transport/config.go#L203-L239","documentation":"The proxy URL supplied for the CLI proxy plugin (env var CLI_PROXY_ADDRESS) contains a URI fragment (a '#...' suffix). The transport layer accepts only a bare scheme://host:port proxy address, so any URL with a fragment is rejected during proxyURL validation. This keeps the proxy address unambiguous, since fragments have no meaning for an HTTP proxy endpoint.","triggerScenarios":"Setting CLI_PROXY_ADDRESS (or the proxy plugin config URL) to a value containing a '#', e.g. 'http://proxy.local:8080#default', then starting the CLI so ApplyToTransport -> proxyURL validates it.","commonSituations":"Copy-pasting a proxy URL from a dashboard or docs where an anchor was appended; shell scripts that append comment-like suffixes; YAML/JSON config where a '#' was meant as a comment but ended up inside a quoted string.","solutions":["Remove everything from the '#' onward in the CLI_PROXY_ADDRESS value.","Re-check the proxy plugin config file for a quoted '#...' inside the URL string and strip it.","If '#...' came from documentation, verify it was an anchor, not part of the address, and use only scheme://host:port."],"exampleFix":"// before\nexport LARKSUITE_CLI_PROXY_ADDRESS=\"http://proxy.corp:8080#main\"\n// after\nexport LARKSUITE_CLI_PROXY_ADDRESS=\"http://proxy.corp:8080\"","handlingStrategy":"validation","validationCode":"u, err := url.Parse(os.Getenv(\"LARKSUITE_CLI_PROXY_ADDRESS\"))\nif err != nil || u.Fragment != \"\" || u.RawQuery != \"\" || u.Path != \"\" {\n\treturn fmt.Errorf(\"proxy address must be scheme://host:port only\")\n}","typeGuard":"func isBareProxyURL(raw string) bool {\n\tu, err := url.Parse(raw)\n\treturn err == nil && u.Fragment == \"\" && u.RawQuery == \"\" && u.Path == \"\" && u.Host != \"\"\n}","tryCatchPattern":null,"preventionTips":["Document CLI_PROXY_ADDRESS as scheme://host:port only.","Trim anchors when copying URLs from browsers/docs.","Add a startup validation step in deployment scripts before launching the CLI."],"tags":["proxy","configuration","url-validation"],"backgroundTag":"invalid-proxy-url","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}