{"record":{"id":"ea295e296d8efe7a","repo":"larksuite/cli","slug":"invalid-s-q-malformed-url","errorCode":null,"errorMessage":"invalid %s %q: malformed URL","messagePattern":"invalid (.+?) %q: malformed URL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/transport/config.go","lineNumber":198,"sourceCode":"\tif b, err := strconv.ParseBool(s); err == nil {\n\t\treturn b, nil\n\t}\n\treturn false, fmt.Errorf(\"invalid %s %q (want true/false/1/0)\", name, raw)\n}\n\n// proxyURL validates the fixed configured proxy configuration and returns its URL.\nfunc (c *Config) proxyURL() (*url.URL, error) {\n\traw := strings.TrimSpace(c.Proxy)\n\tif raw == \"\" {\n\t\treturn nil, fmt.Errorf(\"%s is empty\", envvars.CliProxyAddress)\n\t}\n\tredacted := redactProxyURL(raw)\n\tu, err := url.Parse(raw)\n\tif err != nil {\n\t\t// Do not wrap the raw url.Parse error: its string embeds the original\n\t\t// URL, which can contain userinfo (user:password). Return a redacted,\n\t\t// generic message instead.\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: malformed URL\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Scheme != \"http\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: scheme must be http\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Host == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: missing host\", envvars.CliProxyAddress, redacted)\n\t}\n\t// Security hardening: only allow a loopback proxy. This prevents accidental\n\t// cross-machine proxying of credentials/traffic.\n\tif u.Hostname() != \"127.0.0.1\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: host must be 127.0.0.1\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Port() == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: explicit port is required\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Path != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: path is not allowed\", envvars.CliProxyAddress, redacted)\n\t}","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/transport/config.go#L180-L216","documentation":"proxyURL failed to parse the configured proxy address with net/url.Parse. To avoid leaking credentials, the raw url.Parse error is deliberately not wrapped (it embeds the original URL, which may contain user:password); instead a generic 'malformed URL' message with a redacted address is returned.","triggerScenarios":"LARKSUITE_CLI_PROXY_ADDRESS set to something net/url cannot parse — e.g. control characters, invalid percent-escapes like `http://127.0.0.1:8080/%zz`, or malformed bracketed IPv6 hosts like `http://[::1:8080/` — while proxy mode is enabled.","commonSituations":"Typing the address by hand with a typo; shell interpolation inserting garbage (`http://$HOST:$PORT` with unset vars producing odd strings); pasting a URL containing invisible control characters; template expansion leaving placeholders like {{proxy_host}}.","solutions":["Print the value with delimiters to reveal hidden characters: `echo \"[$LARKSUITE_CLI_PROXY_ADDRESS]\"` (use `| cat -A` to see control chars).","Set a clean, simple address: `export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080`.","Remove any percent-escapes, control characters, or unexpanded template placeholders from the value.","Re-export the variable in the current shell after fixing your profile; verify with `echo $LARKSUITE_CLI_PROXY_ADDRESS`."],"exampleFix":"// before\nexport LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080/%zz\n// after\nexport LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080","handlingStrategy":"validation","validationCode":"addr=\"$LARKSUITE_CLI_PROXY_ADDRESS\"\npython3 -c \"import sys,urllib.parse; urllib.parse.urlparse(sys.argv[1])\" \"$addr\" || echo 'malformed proxy URL' >&2\n# also spot control characters:\nprintf '%s' \"$addr\" | cat -A","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always write the address as a simple http://127.0.0.1:port literal.","Avoid interpolating unquoted/unset shell variables into the value.","Re-type the address rather than pasting from rich text (which can carry invisible characters).","Verify with echo \"[$LARKSUITE_CLI_PROXY_ADDRESS]\" before running the CLI."],"tags":["proxy","url","config","validation"],"backgroundTag":"malformed-url","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}