{"record":{"id":"fae1cfe6fb305eaf","repo":"apache/shenyu","slug":"resolved-ip-address-is-not-allowed-address-gethostaddress","errorCode":null,"errorMessage":"Resolved IP address is not allowed: \" + address.getHostAddress()","messagePattern":"Resolved IP address is not allowed: \" \\+ address\\.getHostAddress\\(\\)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java","lineNumber":106,"sourceCode":"        }\n\n        // Check for private IP addresses\n        if (isPrivateOrInternalIP(normalizedHost)) {\n            throw new IllegalArgumentException(\"Access to private or internal IP addresses is not allowed\");\n        }\n\n        // Check for sensitive ports\n        if (isSensitivePort(port)) {\n            throw new IllegalArgumentException(\"Access to sensitive ports is not allowed\");\n        }\n\n        // Additional validation for DNS resolution\n        try {\n            InetAddress[] addresses = InetAddress.getAllByName(normalizedHost);\n            for (InetAddress address : addresses) {\n                if (address.isLoopbackAddress() || address.isLinkLocalAddress()\n                        || address.isSiteLocalAddress() || address.isAnyLocalAddress()) {\n                    throw new IllegalArgumentException(\"Resolved IP address is not allowed: \" + address.getHostAddress());\n                }\n\n                // Check resolved IP against private ranges\n                if (isPrivateIPAddress(address.getHostAddress())) {\n                    throw new IllegalArgumentException(\"Resolved IP address is private: \" + address.getHostAddress());\n                }\n            }\n        } catch (UnknownHostException e) {\n            throw new IllegalArgumentException(\"Cannot resolve host: \" + host);\n        }\n    }\n\n    /**\n     * Check if the host is localhost or localhost variations.\n     *\n     * @param host the host to check\n     * @return true if the host is localhost\n     */","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java#L88-L124","documentation":"After resolving the host via InetAddress.getAllByName, validateHostForSSRF throws this IllegalArgumentException if any resolved address is loopback, link-local, site-local, or the wildcard/any-local address. This closes the DNS-rebinding-style gap where a benign hostname resolves to a dangerous internal IP.","triggerScenarios":"Validating a hostname whose DNS records include 127.0.0.0/8, 169.254.x, 10.x/172.16-31.x/192.168.x, or 0.0.0.0 — e.g. http://localhost.example.com or a hostname pointing at 127.0.0.1.","commonSituations":"DNS entries (or /etc/hosts overrides) mapping service names to loopback or private addresses; testing in containers where the target resolves to a link-local or loopback address.","solutions":["Give the target host a public DNS record that resolves only to non-private, non-loopback addresses.","Clean up /etc/hosts or DNS entries that map the hostname to 127.0.0.1 or link-local addresses.","If the service must stay internal, call it directly rather than through the SSRF-validated path."],"exampleFix":"// before (hosts file: service.local -> 127.0.0.1)\nUrlSecurityUtils.validateUrlForSSRF(\"http://service.local/api\");\n// after (service.local -> public IP)\nUrlSecurityUtils.validateUrlForSSRF(\"https://service.example.com/api\");","handlingStrategy":"try-catch","validationCode":"InetAddress[] addrs = InetAddress.getAllByName(host);\nfor (InetAddress a : addrs) {\n    if (a.isLoopbackAddress() || a.isLinkLocalAddress() || a.isSiteLocalAddress() || a.isAnyLocalAddress()) {\n        throw new IllegalArgumentException(\"resolves to restricted IP: \" + a.getHostAddress());\n    }\n}","typeGuard":"boolean resolvesPublicly(String host) throws UnknownHostException {\n    return Arrays.stream(InetAddress.getAllByName(host))\n        .noneMatch(a -> a.isLoopbackAddress() || a.isSiteLocalAddress() || a.isLinkLocalAddress());\n}","tryCatchPattern":"try {\n    UrlSecurityUtils.validateUrlForSSRF(url);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Host resolves to disallowed address: {}\", e.getMessage());\n}","preventionTips":["Keep /etc/hosts free of entries mapping configured hostnames to 127.0.0.1.","Publish proper public DNS records for services referenced by admin URLs.","Re-check DNS after infra changes; stale records often point at private IPs."],"tags":["ssrf","dns","security","network"],"backgroundTag":"invalid-url","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}