apple/pkl · error · IllegalArgumentException

malformedProxyAddress

malformedProxyAddress

Error message

malformedProxyAddress: ${proxyAddress}

What it means

The proxy address configured for Pkl's HTTP client is not a valid HTTP proxy URI. ProxySelector's public constructor requires an http-scheme URL with a host, no path, and no userinfo; anything else throws this IllegalArgumentException.

Source

Thrown at pkl-core/src/main/java/org/pkl/core/http/ProxySelector.java:46

final class ProxySelector extends java.net.ProxySelector {

  public static final List<Proxy> NO_PROXY = List.of(Proxy.NO_PROXY);

  private final @Nullable List<Proxy> myProxy;
  private final List<NoProxyRule> noProxyRules;
  private final java.net.@Nullable ProxySelector delegate;

  ProxySelector(@Nullable URI proxyAddress, List<String> noProxyRules) {
    this.noProxyRules = noProxyRules.stream().map(NoProxyRule::new).toList();
    if (proxyAddress == null) {
      this.delegate = java.net.ProxySelector.getDefault();
      this.myProxy = null;
    } else {
      if (!proxyAddress.getScheme().equalsIgnoreCase("http")
          || proxyAddress.getHost() == null
          || !proxyAddress.getPath().isEmpty()
          || proxyAddress.getUserInfo() != null) {
        throw new IllegalArgumentException(
            ErrorMessages.create("malformedProxyAddress", proxyAddress));
      }
      this.delegate = null;
      var port = proxyAddress.getPort();
      if (port == -1) {
        port = 80;
      }
      this.myProxy =
          List.of(new Proxy(Proxy.Type.HTTP, new InetSocketAddress(proxyAddress.getHost(), port)));
    }
  }

  @Override
  @ExplodeLoop
  public List<Proxy> select(URI uri) {
    for (var proxyRule : noProxyRules) {
      if (proxyRule.matches(uri)) {
        return NO_PROXY;

View on GitHub (pinned to f3efcbfc9b)

Solutions

1. Change the scheme to http:// (Pkl expects an http proxy address even for HTTPS tunneling via CONNECT).
2. Remove any path suffix and userinfo (user:password@) from the proxy URL.
3. Ensure the URL includes a hostname/IP, e.g. http://proxy.example.com:3128.
4. If the proxy needs auth, supply credentials through the library's supported proxy-auth mechanism rather than embedding them in the URL.
5. Check env vars (HTTP_PROXY/HTTPS_PROXY/ALL_PROXY) for malformed values Pkl may be consuming.

Example fix

// before (pkl)
http { proxy = "https://user:pass@proxy.corp:3128/dashboard" }
// after (pkl)
http { proxy = "http://proxy.corp:3128" }

URI proxy = URI.create(proxyAddress);
boolean valid = "http".equalsIgnoreCase(proxy.getScheme())
    && proxy.getHost() != null
    && (proxy.getPath() == null || proxy.getPath().isEmpty())
    && proxy.getUserInfo() == null;
if (!valid) throw new IllegalArgumentException("Invalid proxy address: " + proxyAddress);

try {
  // build HTTP client
} catch (IllegalArgumentException e) {
  if (e.getMessage().startsWith("malformedProxyAddress")) {
    // rewrite the proxy URL to http://host:port and retry
  }
}

When it happens

Trigger: Creating an HTTP client (or setting the http.proxy config option / proxy environment) with an address that: uses a non-http scheme (e.g. https:// or socks5://), has no host, has a path component, or embeds user:password userinfo.

Common situations: Setting `proxy = "https://proxy.corp:3128"` when Pkl expects plain http for the CONNECT target, adding `http://user:pass@proxy:8080` credentials inline, or including a trailing path like `http://proxy:8080/`.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• invalidUri
• cannotFindCertFile
• emptyCertFile
• Failed to parse hostname in no-proxy rule: ${repr}
• Failed to convert `pkl.base#String` to `java.net.URL`.

AI-assisted analysis of apple/pkl@f3efcbfc9b (2026-09-08). Data as JSON: /api/errors/c55e04ffc6ce30fe. Report an issue: GitHub.