{"record":{"id":"fc1a50d61acee3d7","repo":"Tencent/WeKnora","slug":"unsafe-obs-endpoint-w","errorCode":null,"errorMessage":"unsafe OBS endpoint: %w","messagePattern":"unsafe OBS endpoint: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/file/obs.go","lineNumber":48,"sourceCode":"\ntype obsEndpointResolver struct {\n\turl string\n}\n\nfunc (r *obsEndpointResolver) ResolveEndpoint(region string, options s3.EndpointResolverOptions) (aws.Endpoint, error) {\n\treturn aws.Endpoint{\n\t\tURL:               r.url,\n\t\tSigningRegion:     region,\n\t\tHostnameImmutable: true,\n\t}, nil\n}\n\nfunc NewObsFileService(\n\tendpoint, region, accessKeyID, secretAccessKey, bucketName string,\n\tpathPrefix string,\n) (interfaces.FileService, error) {\n\tif err := utils.ValidateURLForSSRF(endpoint); err != nil {\n\t\treturn nil, fmt.Errorf(\"unsafe OBS endpoint: %w\", err)\n\t}\n\n\tclient := s3.New(s3.Options{\n\t\tRegion:           region,\n\t\tEndpointResolver: &obsEndpointResolver{url: endpoint},\n\t\tCredentials:      credentials.NewStaticCredentialsProvider(accessKeyID, secretAccessKey, \"\"),\n\t\tUsePathStyle:     true,\n\t\tHTTPClient:       utils.NewSSRFSafeHTTPClient(utils.DefaultSSRFSafeHTTPClientConfig()),\n\t})\n\n\t_, err := client.HeadBucket(context.Background(), &s3.HeadBucketInput{\n\t\tBucket: aws.String(bucketName),\n\t})\n\tif err != nil {\n\t\t_, createErr := client.CreateBucket(context.Background(), &s3.CreateBucketInput{\n\t\t\tBucket: aws.String(bucketName),\n\t\t})\n\t\tif createErr != nil {","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/file/obs.go#L30-L66","documentation":"OBS constructor SSRF guard: the configured endpoint URL failed ValidateURLForSSRF, meaning it targets a forbidden host (localhost, link-local, private/reserved ranges, or a disallowed scheme), so the client refuses to initialize to prevent server-side request forgery via storage config.","triggerScenarios":"Thrown at internal/application/service/file/obs.go:48 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Point the OBS endpoint at a legitimate public service endpoint","Allowlist the intended endpoint in SSRF validation config","Reject storage configs with internal addresses at save time"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}