{"record":{"id":"ec27b761110ec994","repo":"Tencent/WeKnora","slug":"invalid-proxy-url-w","errorCode":null,"errorMessage":"invalid proxy_url: %w","messagePattern":"invalid proxy_url: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/infrastructure/web_search/proxy.go","lineNumber":40,"sourceCode":"// NewSearchHTTPClient builds an http.Client for outbound web search requests.\n// It uses utils.SSRFSafeDialContext, optional explicit or environment proxy, and\n// redirect validation consistent with utils.NewSSRFSafeHTTPClient.\nfunc NewSearchHTTPClient(timeout time.Duration, proxyURL string) (*http.Client, error) {\n\tproxyURL = strings.TrimSpace(proxyURL)\n\tdef, ok := http.DefaultTransport.(*http.Transport)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"default HTTP transport is not *http.Transport\")\n\t}\n\tt := def.Clone()\n\tt.DialContext = utils.SSRFSafeDialContext\n\n\tif proxyURL != \"\" {\n\t\tif err := ValidateProxyURL(proxyURL); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tu, err := url.Parse(proxyURL)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid proxy_url: %w\", err)\n\t\t}\n\t\tif u.Scheme == \"\" || u.Host == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"invalid proxy_url: scheme and host are required\")\n\t\t}\n\t\tt.Proxy = http.ProxyURL(u)\n\t} else {\n\t\tt.Proxy = http.ProxyFromEnvironment\n\t}\n\n\tcfg := utils.DefaultSSRFSafeHTTPClientConfig()\n\tcfg.Timeout = timeout\n\treturn utils.NewSSRFSafeHTTPClientWithTransport(cfg, t), nil\n}\n","sourceCodeStart":22,"sourceCodeEnd":54,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/infrastructure/web_search/proxy.go#L22-L54","documentation":"Returned by NewSearchHTTPClient when the supplied proxyURL (after trimming) fails Validate — i.e. it is not a well-formed proxy URL with an acceptable scheme. The client refuses to build an outbound search HTTP client with an untrusted proxy, so all providers created with this proxy fail at construction.","triggerScenarios":"NewSearchHTTPClient called with a proxyURL string that url.Parse rejects, e.g. \"http://[bad-ipv6\", or strings containing invalid percent-escapes like \"http://host:port%x\".","commonSituations":"Typos in the proxy config, copy-pasted proxy strings with stray characters or spaces in unusual positions, environment-specific config files with corrupted values.","solutions":["Correct the proxy_url to a full absolute URL with http/https scheme","Clear the proxy setting to use direct/environment proxy resolution"],"exampleFix":"// before\nproxyURL := \"http://[fe80::1:8080\" // malformed IPv6\n// after\nproxyURL := \"http://[fe80::1]:8080\"","handlingStrategy":"validation","validationCode":"func checkProxyURL(raw string) error {\n    raw = strings.TrimSpace(raw)\n    if raw == \"\" {\n        return nil\n    }\n    if _, err := url.Parse(raw); err != nil {\n        return fmt.Errorf(\"proxy_url unparseable: %w\", err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"client, err := web_search.NewSearchHTTPClient(timeout, proxyURL)\nif err != nil {\n    if strings.Contains(err.Error(), \"invalid proxy_url\") {\n        return fmt.Errorf(\"config error in proxy_url %q: %w\", proxyURL, err)\n    }\n    return err\n}","preventionTips":["Run url.Parse on proxy config at startup, fail fast","Quote and escape special characters in proxy URLs in YAML/env files","Keep proxy settings in one validated config struct","Test proxy connectivity separately from provider logic"],"tags":["url","proxy","configuration","parse-error"],"backgroundTag":"invalid-proxy-url","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}