flipped-aurora/gin-vue-admin · error

URL 非法: %w

Error message

URL 非法: %w

What it means

runHTTP parses t.HttpUrl with url.Parse before issuing the callback. If parsing fails (malformed URL syntax), the run is rejected early with a wrapped "URL 非法" error. This is a pre-flight validation step in the SSRF-protected HTTP executor.

Source

Thrown at server/service/system/sys_timed_task_runner.go:129

		}()
		done <- fn(ctx, json.RawMessage(t.Params))
	}()
	select {
	case err := <-done:
		if err != nil && errors.Is(err, context.DeadlineExceeded) {
			return "", errTaskTimeout
		}
		return "", err
	case <-ctx.Done():
		return "", errTaskTimeout
	}
}

// runHTTP 执行 HTTP 回调(SSRF 防护见 sys_timed_task_http.go)
func (s *TimedTaskService) runHTTP(t system.SysTimedTask) (string, error) {
	u, err := url.Parse(t.HttpUrl)
	if err != nil {
		return "", fmt.Errorf("URL 非法: %w", err)
	}
	if u.Scheme != "http" && u.Scheme != "https" {
		return "", fmt.Errorf("仅允许 http/https, 实际为 %q", u.Scheme)
	}
	method := strings.ToUpper(strings.TrimSpace(t.HttpMethod))
	if method == "" {
		method = http.MethodGet
	}
	var body io.Reader
	if t.HttpBody != "" {
		body = strings.NewReader(t.HttpBody)
	}
	req, err := http.NewRequest(method, t.HttpUrl, body)
	if err != nil {
		return "", fmt.Errorf("构造请求失败: %w", err)
	}
	if len(t.HttpHeader) > 0 {
		var hdr map[string]string

View on GitHub (pinned to 3136500ef3)

Solutions

1. Correct the task's http_url value to a well-formed absolute URL
2. Trim whitespace before saving the URL in the admin form
3. Pre-validate with url.ParseRequestURI in the client code that creates the task

Example fix

// before
HttpUrl: "http:// example.com/hook"
// after
HttpUrl: "http://example.com/hook"

u, err := url.Parse(httpUrl)
if err != nil || u.Host == "" {
    return errors.New("callback URL is not a valid absolute URL")
}

func isParseableURL(s string) bool {
    u, err := url.Parse(s)
    return err == nil && u.Host != ""
}

if err := RunTask(t); err != nil {
    if strings.Contains(err.Error(), "URL 非法") {
        log.Warnf("task %d has malformed URL %q", t.ID, t.HttpUrl)
    }
}

When it happens

Trigger: t.HttpUrl contains an unparseable value: spaces, missing scheme fragments like '://', control characters, or invalid percent-encoding that url.Parse rejects.

Common situations: Admin saved a URL with a trailing space or newline; copied URL with invisible characters; stored empty/garbage http_url column.

Related errors

• 仅允许 http/https, 实际为 %q
• 构造请求失败: %w
• http_header 必须是 JSON 对象: %w
• 非 2xx 响应: %d
• LLM request failed

AI-assisted analysis of flipped-aurora/gin-vue-admin@3136500ef3 (2026-08-31). Data as JSON: /api/errors/58cc48f171cac702. Report an issue: GitHub.