{"record":{"id":"eab9bf9d0c879338","repo":"XX-net/XX-Net","slug":"app-check-content-s","errorCode":null,"errorMessage":"app check content:%s","messagePattern":"app check content:(.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"code/default/gae_proxy/local/check_ip.py","lineNumber":79,"sourceCode":"                return False\n            else:\n                return True\n\n        try:\n            content = response.read()\n        except Exception as e:\n            if sys.version_info[0] == 3 and (\n                    isinstance(e, ConnectionError) or\n                    isinstance(e, ConnectionResetError) or\n                    isinstance(e, BrokenPipeError)\n            ):\n                return False\n\n            self.logger.warn(\"app check except:%r\", e)\n            return False\n\n        if self.config.check_ip_content not in content:\n            self.logger.warn(\"app check content:%s\", content)\n            return False\n\n        return True\n\n\nclass CheckAllIp(object):\n\n    def __init__(self):\n        ca_certs = os.path.join(current_path, \"cacert.pem\")\n        openssl_context = SSLContext(\n            logger, ca_certs=ca_certs,\n            cipher_suites=[b'ALL', b\"!RC4-SHA\", b\"!ECDHE-RSA-RC4-SHA\", b\"!ECDHE-RSA-AES128-GCM-SHA256\",\n                           b\"!AES128-GCM-SHA256\", b\"!ECDHE-RSA-AES128-SHA\", b\"!AES128-SHA\"]\n        )\n        host_manager = HostManager()\n        connect_creator = ConnectCreator(logger, config, openssl_context, host_manager,\n                                         debug=True)\n        self.check_ip = CheckIp(logger, config, connect_creator)","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/XX-net/XX-Net/blob/cfa5bc17b67676e467f37ec50766127e0ab5f0aa/code/default/gae_proxy/local/check_ip.py#L61-L97","documentation":"The check request succeeded and content was read, but the expected marker (config.check_ip_content) is not present in the response body — the IP responded but not with a genuine GFE app-check reply. IP is rejected.","triggerScenarios":"check_ip hitting an endpoint whose 200-response body lacks the expected content string — spoofed responses, hijacked DNS/IP, or Google changing the check URL's response.","commonSituations":"Firewall/ISP injecting fake 200 pages, GFE behavior change requiring a new check URL/content, or proxy interference.","solutions":["Update XX-Net so check_ip_url/check_ip_content match current GFE behavior","If all IPs fail content check, suspect response injection — test from another network","Manually curl the check URL from a good IP to see what content is returned","Refill the IP list with fresh scanned ranges"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep check_ip_url/content config updated with the deployed version","Verify check endpoint manually when all IPs fail content check","Watch for injected responses on hostile networks"],"tags":["gae-proxy","ip-check","content-validation"],"backgroundTag":"health-check-content-mismatch","analyzedSha":"cfa5bc17b67676e467f37ec50766127e0ab5f0aa","analyzedAt":"2026-08-27T19:28:28.225Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}