{"record":{"id":"ecf14e21ece87736","repo":"apache/shenyu","slug":"resolved-ip-address-is-private-address-gethostaddress","errorCode":null,"errorMessage":"Resolved IP address is private: \" + address.getHostAddress()","messagePattern":"Resolved IP address is private: \" \\+ address\\.getHostAddress\\(\\)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java","lineNumber":111,"sourceCode":"        }\n\n        // Check for sensitive ports\n        if (isSensitivePort(port)) {\n            throw new IllegalArgumentException(\"Access to sensitive ports is not allowed\");\n        }\n\n        // Additional validation for DNS resolution\n        try {\n            InetAddress[] addresses = InetAddress.getAllByName(normalizedHost);\n            for (InetAddress address : addresses) {\n                if (address.isLoopbackAddress() || address.isLinkLocalAddress()\n                        || address.isSiteLocalAddress() || address.isAnyLocalAddress()) {\n                    throw new IllegalArgumentException(\"Resolved IP address is not allowed: \" + address.getHostAddress());\n                }\n\n                // Check resolved IP against private ranges\n                if (isPrivateIPAddress(address.getHostAddress())) {\n                    throw new IllegalArgumentException(\"Resolved IP address is private: \" + address.getHostAddress());\n                }\n            }\n        } catch (UnknownHostException e) {\n            throw new IllegalArgumentException(\"Cannot resolve host: \" + host);\n        }\n    }\n\n    /**\n     * Check if the host is localhost or localhost variations.\n     *\n     * @param host the host to check\n     * @return true if the host is localhost\n     */\n    private static boolean isLocalhost(final String host) {\n        Set<String> localhostVariations = new HashSet<>(Arrays.asList(\n                \"localhost\", \"127.0.0.1\", \"::1\", \"0.0.0.0\", \"0000:0000:0000:0000:0000:0000:0000:0001\"\n        ));\n        return localhostVariations.contains(host);","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java#L93-L129","documentation":"validateHostForSSRF performs a second pass over each DNS-resolved address using the custom isPrivateIPAddress() range check (beyond InetAddress's built-in flags). If any resolved IP falls in a configured private range, it throws this IllegalArgumentException. It exists to catch private ranges the JDK flags do not cover.","triggerScenarios":"Validating a hostname whose DNS resolves to an IP matched by isPrivateIPAddress() (e.g. CGNAT 100.64.x, other internal CIDR ranges), even when InetAddress.isSiteLocalAddress() returns false.","commonSituations":"Deployments behind NAT64/CGNAT or corporate ranges (100.64.0.0/10, 198.18.0.0/15) where the service hostname legitimately resolves to such addresses.","solutions":["Use a hostname that resolves to a public address.","If your environment legitimately uses these ranges, route through a public proxy endpoint instead.","For tests, extend the private-range list only in test scopes; keep production ranges strict."],"exampleFix":"// before\nUrlSecurityUtils.validateUrlForSSRF(\"http://svc.internal:8080\"); // resolves to 100.64.1.5\n// after\nUrlSecurityUtils.validateUrlForSSRF(\"https://svc.example.com\");","handlingStrategy":"try-catch","validationCode":"InetAddress[] addrs = InetAddress.getAllByName(host);\nfor (InetAddress a : addrs) {\n    if (isPrivateIPAddress(a.getHostAddress())) {\n        throw new IllegalArgumentException(\"resolves to private range: \" + a.getHostAddress());\n    }\n}","typeGuard":"boolean allResolvedIpsPublic(String host) throws UnknownHostException {\n    return Arrays.stream(InetAddress.getAllByName(host))\n        .allMatch(a -> !isPrivateIPAddress(a.getHostAddress()));\n}","tryCatchPattern":"try {\n    UrlSecurityUtils.validateUrlForSSRF(url);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Resolved IP in private range: {}\", e.getMessage());\n}","preventionTips":["Know your network's address plan (CGNAT, corporate ranges) before registering URLs.","Front internal services with a public-facing gateway endpoint.","Test hostname resolution from the admin host, not your laptop."],"tags":["ssrf","dns","security","ip-range"],"backgroundTag":"invalid-url","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}