{"id":"4ef49ba566fead51","repo":"google/gson","slug":"failed-parsing-s-as-inetaddress-at-path","errorCode":null,"errorMessage":"Failed parsing '\" + s + \"' as InetAddress; at path \" + in.getPreviousPath() + \"; to allow DNS addresses, set system property gson.allowDnsInetAddress to \\\"true\\\"\"","messagePattern":"Failed parsing '\" \\+ s \\+ \"' as InetAddress; at path \" \\+ in\\.getPreviousPath\\(\\) \\+ \"; to allow DNS addresses, set system property gson\\.allowDnsInetAddress to \\\\\"true\\\\\"\"","errorType":"exception","errorClass":"JsonSyntaxException","httpStatus":null,"severity":"error","filePath":"gson/src/main/java/com/google/gson/internal/bind/TypeAdapters.java","lineNumber":758,"sourceCode":"  public static final TypeAdapter<InetAddress> INET_ADDRESS =\n      new TypeAdapter<InetAddress>() {\n\n        // A pattern that matches every IP address and no DNS address. It matches plenty of things\n        // that aren't either of those, which is fine. An IPv4 address is n.n.n.n where each n is a\n        // non-negative integer. An IPv6 address contains at least one colon. (There are further\n        // constraints in both cases, but they don't matter here.)\n        private final Pattern ipAddressPattern = Pattern.compile(\".*:.*|[0-9]+(\\\\.[0-9]+){3}\");\n\n        @Override\n        public InetAddress read(JsonReader in) throws IOException {\n          if (in.peek() == JsonToken.NULL) {\n            in.nextNull();\n            return null;\n          }\n          String s = in.nextString();\n          if (!ipAddressPattern.matcher(s).matches()\n              && !Boolean.getBoolean(\"gson.allowDnsInetAddress\")) {\n            throw new JsonSyntaxException(\n                \"Failed parsing '\"\n                    + s\n                    + \"' as InetAddress; at path \"\n                    + in.getPreviousPath()\n                    + \"; to allow DNS addresses, set system property gson.allowDnsInetAddress to\"\n                    + \" \\\"true\\\"\");\n          }\n          @SuppressWarnings(\"AddressSelection\")\n          InetAddress addr = InetAddress.getByName(s);\n          return addr;\n        }\n\n        @Override\n        public void write(JsonWriter out, InetAddress value) throws IOException {\n          out.value(value == null ? null : value.getHostAddress());\n        }\n      };\n","sourceCodeStart":740,"sourceCodeEnd":776,"githubUrl":"https://github.com/google/gson/blob/8b8628c65699bc4421696183c62ae0c1b9b281dc/gson/src/main/java/com/google/gson/internal/bind/TypeAdapters.java#L740-L776","documentation":"Gson's InetAddress adapter rejects any string that does not look like an IP address (the regex '.*:.*|[0-9]+(\\.[0-9]+){3}') unless the system property gson.allowDnsInetAddress is set to \"true\". This is a deliberate security measure to prevent deserialization from triggering DNS lookups against attacker-controlled hostnames. Non-IP strings therefore throw JsonSyntaxException.","triggerScenarios":"Deserializing a JSON string such as \"example.com\" or \"localhost\" into an InetAddress field while gson.allowDnsInetAddress is not enabled.","commonSituations":"Service configs that store hostnames rather than IPs, containerized environments where the field legitimately holds a DNS name, or migrating from an older Gson that allowed hostnames freely.","solutions":["If DNS resolution during deserialization is acceptable in your trust model, set -Dgson.allowDnsInetAddress=true on the JVM.","Prefer storing/resolving IP literals in the JSON data so no DNS lookup is needed.","Register a custom TypeAdapter<InetAddress> that resolves hostnames explicitly under your control.","Deserialize the value as String and call InetAddress.getByName yourself in application code with input validation."],"exampleFix":"// before\nInetAddress addr = gson.fromJson(\"\\\"my-host\\\"\", InetAddress.class);\n\n// after (only if you accept the DNS-lookup risk)\nSystem.setProperty(\"gson.allowDnsInetAddress\", \"true\");\nInetAddress addr = gson.fromJson(\"\\\"my-host\\\"\", InetAddress.class);","handlingStrategy":"validation","validationCode":"boolean isParsableInetAddress(String s) {\n  if (s == null || s.isEmpty()) return false;\n  if (s.contains(\":\") || s.matches(\"[0-9]+(\\\\.[0-9]+){3}\")) return true;\n  return Boolean.getBoolean(\"gson.allowDnsInetAddress\");\n}","typeGuard":"static boolean isIpLiteral(String s) {\n  return s != null && (s.contains(\":\") || s.matches(\"[0-9]+(\\\\.[0-9]+){3}\"));\n}","tryCatchPattern":"try {\n  InetAddress a = gson.fromJson(json, InetAddress.class);\n} catch (JsonSyntaxException e) {\n  // if DNS is expected/trusted, set gson.allowDnsInetAddress and retry; otherwise reject input\n}","preventionTips":["Prefer storing IP literals in serialized data.","Only enable gson.allowDnsInetAddress when input is from a trusted source, to avoid SSRF via deserialization.","Resolve hostnames in application code with explicit validation rather than at deserialization time."],"tags":["gson","deserialization","inet-address","networking","security","dns"],"analyzedSha":"8b8628c65699bc4421696183c62ae0c1b9b281dc","analyzedAt":"2026-08-04T19:12:22.202Z","schemaVersion":2}