{"record":{"id":"fc4d791e3a702ad2","repo":"googleapis/mcp-toolbox","slug":"invalid-allowedipranges-w","errorCode":null,"errorMessage":"invalid allowedIpRanges: %w","messagePattern":"invalid allowedIpRanges: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/http/http.go","lineNumber":122,"sourceCode":"\t}\n\n\tif r.DisableSslVerification {\n\t\ttr.TLSClientConfig = &tls.Config{\n\t\t\tInsecureSkipVerify: true,\n\t\t}\n\n\t\tlogger.WarnContext(ctx, \"WARNING: TLS certificate verification is skipped (InsecureSkipVerify: true) for HTTP source %s. This exposes all traffic for this source to Man-in-the-Middle (MITM) attacks. Do not use in production.\", r.Name)\n\t}\n\n\t// Validate BaseURL\n\tparsedURL, err := url.ParseRequestURI(r.BaseURL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse BaseUrl %v\", err)\n\t}\n\n\tallowedRanges, err := parseCIDRs(r.AllowedIPRanges)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid allowedIpRanges: %w\", err)\n\t}\n\n\tcustomBlocked, err := parseCIDRs(r.CustomBlockedIPRanges)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid customBlockedIpRanges: %w\", err)\n\t}\n\n\tguard := &SSRFGuard{\n\t\tAllowPrivateNetworks: r.AllowPrivateNetworks,\n\t\tAllowedRanges:        allowedRanges,\n\t\tCustomBlocked:        customBlocked,\n\t}\n\n\t// Quick fast-fail check for direct IP configurations in the YAML\n\tif ip := net.ParseIP(parsedURL.Hostname()); ip != nil {\n\t\tif guard.IsIPBlocked(ip) {\n\t\t\treturn nil, fmt.Errorf(\"invalid BaseURL %s: points to a blocked internal IP address\", r.BaseURL)\n\t\t}","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/http/http.go#L104-L140","documentation":"This error is returned when parseCIDRs fails on the http source's allowedIpRanges configuration. Each entry must be a valid CIDR block (e.g. 10.0.0.0/8, 192.168.1.0/24); malformed IPs, missing prefixes, or non-CIDR hostnames cause the parse to fail and abort source initialization. This list gates which destination IPs the source is allowed to contact (SSRF protection).","triggerScenarios":"parseCIDRs(r.AllowedIPRanges) returns non-nil err: entries like \"10.0.0.1\" (no /prefix), \"10.0.0.0/33\" (invalid prefix), \"myhost.local\" (not a CIDR), empty strings, or mixed invalid values in the comma/list field.","commonSituations":"Listing plain IPs without prefix lengths; typos in prefix numbers; pasting AWS security-group descriptions instead of CIDRs; whitespace or empty items in the list.","solutions":["Convert plain IPs to CIDR form: \"10.0.0.1\" → \"10.0.0.1/32\"","Validate each prefix is 0–32 (IPv4) and the address parses, e.g. with `ipcalc` or net.ParseCIDR in a scratch program","Remove empty entries and surrounding whitespace from the allowedIpRanges list"],"exampleFix":"// before\nallowedIpRanges:\n  - 10.0.0.1\n  - 192.168.1.0/24\n// after\nallowedIpRanges:\n  - 10.0.0.1/32\n  - 192.168.1.0/24","handlingStrategy":"validation","validationCode":"func validCIDRs(items []string) bool {\n    for _, c := range items {\n        if _, _, err := net.ParseCIDR(strings.TrimSpace(c)); err != nil {\n            return false\n        }\n    }\n    return true\n}\n// usage: if !validCIDRs(cfg.AllowedIPRanges) { fix list before Initialize }","typeGuard":null,"tryCatchPattern":"src, err := cfg.Initialize(ctx, tracer)\nif err != nil && strings.Contains(err.Error(), \"invalid allowedIpRanges\") {\n    log.Fatalf(\"each allowedIpRanges entry must be valid CIDR, e.g. 10.0.0.0/8: %v\", err)\n}","preventionTips":["Use /32 for single-host entries instead of bare IPs","Validate entries with net.ParseCIDR or ipcalc before commit","Keep the list free of empty strings and stray whitespace"],"tags":["http","configuration","cidr","validation","security"],"backgroundTag":"invalid-cidr-configuration","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}