{"record":{"id":"faa55de0ebc08834","repo":"kgretzky/evilginx2","slug":"invalid-ip-address-s","errorCode":null,"errorMessage":"invalid ip address: %s","messagePattern":"invalid ip address: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/blacklist.go","lineNumber":85,"sourceCode":"\n\tlog.Info(\"blacklist: loaded %d ip addresses and %d ip masks\", len(bl.ips), len(bl.masks))\n\treturn bl, nil\n}\n\nfunc (bl *Blacklist) GetStats() (int, int) {\n\treturn len(bl.ips), len(bl.masks)\n}\n\nfunc (bl *Blacklist) AddIP(ip string) error {\n\tif bl.IsBlacklisted(ip) {\n\t\treturn nil\n\t}\n\n\tipv4 := net.ParseIP(ip)\n\tif ipv4 != nil {\n\t\tbl.ips[ipv4.String()] = &BlockIP{ipv4: ipv4, mask: nil}\n\t} else {\n\t\treturn fmt.Errorf(\"invalid ip address: %s\", ip)\n\t}\n\n\t// write to file\n\tf, err := os.OpenFile(bl.configPath, os.O_APPEND|os.O_WRONLY, 0644)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer f.Close()\n\n\t_, err = f.WriteString(ipv4.String() + \"\\n\")\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n\nfunc (bl *Blacklist) IsBlacklisted(ip string) bool {","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/blacklist.go#L67-L103","documentation":"AddIP validates its argument with net.ParseIP and throws this error when the string is not a valid IPv4 or IPv6 address. The IP is neither added to the in-memory blocklist nor appended to the config file, so the blacklist state remains unchanged. It is a fail-fast input validation error.","triggerScenarios":"Calling AddIP (e.g. from the blacklist HTTP handler <anonymous> function) with a value like \"banana\", \"256.1.1.1\", \"10.0.0.999\", a CIDR like \"192.168.0.0/24\" (CIDR notation is not accepted here), or an empty string obtained from a missing query parameter.","commonSituations":"Automated scripts adding IPs with CIDR notation instead of a bare address; client sending a hostname instead of an IP; whitespace or junk in the remote_addr/query string; IPv6 with zone specifier like fe80::1%eth0.","solutions":["Pass a bare, valid IPv4/IPv6 address (e.g. 192.168.1.15 or ::1) to AddIP","Validate with net.ParseIP in the caller before calling AddIP and reject bad input at the HTTP layer","If you need to block a range, resolve or enumerate it yourself and add individual IPs, or extend the BlockIP mask support","Trim whitespace and strip any port (use net.SplitHostPort) before passing the value"],"exampleFix":"// before\nerr := bl.AddIP(r.URL.Query().Get(\"ip\")) // ip=\"192.168.0.0/24\"\n// after\nip, _, _ := net.SplitHostPort(r.RemoteAddr)\nif net.ParseIP(ip) == nil {\n    http.Error(w, \"bad ip\", 400)\n    return\n}\nerr := bl.AddIP(ip)","handlingStrategy":"validation","validationCode":"func validIP(s string) bool {\n    return net.ParseIP(strings.TrimSpace(s)) != nil\n}\n// reject before AddIP if !validIP(input)","typeGuard":"func asIP(s string) (net.IP, bool) {\n    ip := net.ParseIP(strings.TrimSpace(s))\n    return ip, ip != nil\n}","tryCatchPattern":"if err := bl.AddIP(raw); err != nil {\n    if strings.HasPrefix(err.Error(), \"invalid ip address:\") {\n        http.Error(w, \"provide a bare IPv4/IPv6 address\", http.StatusBadRequest)\n        return\n    }\n    return err\n}","preventionTips":["Validate with net.ParseIP before adding","Strip CIDR suffixes and ports; CIDR notation is not accepted","Trim whitespace from user-supplied input","Never pass hostnames where IPs are expected; resolve first"],"tags":["network","validation","ip-address"],"backgroundTag":"invalid-ip-address","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}