google/tsunami-security-scanner · error · ValueError

Invalid network service

Error message

Invalid network service: %s

What it means

network_service_utils.build_web_application_root_url() raises ValueError when the given NetworkService is not a web service (i.e. is_web_service() returns False, meaning its service name is not http/https and its port is not a web port). The function can only build a root URL for recognized web protocols.

Solutions

1. Guard with is_web_service(network_service) before calling build_web_application_root_url.
2. Fix service discovery/classification so the service is correctly identified as http/https.
3. Skip non-web services in the plugin loop instead of building web URLs for them.

Example fix

// before
url = network_service_utils.build_web_application_root_url(service)
// after
if network_service_utils.is_web_service(service):
    url = network_service_utils.build_web_application_root_url(service)

assert network_service_utils.is_web_service(service), f"not a web service: {service.network_service}"

def is_safe_web_service(service) -> bool:
    return network_service_utils.is_web_service(service)

try:
    url = network_service_utils.build_web_application_root_url(service)
except ValueError as e:
    logging.warning("Skipping non-web service: %s", e)
    url = None

When it happens

Trigger: Calling build_web_application_root_url with a NetworkService whose network_service is e.g. 'ssh' or 'mysql', or an unrecognized service, at network_service_utils.py:110.

Common situations: Plugin code iterating all discovered network services without filtering; port-scan results classifying a service by banner into a non-web name; assuming any open port is HTTP.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Invalid address family
• URI scheme should be one of the following: 'http', 'https'
• Illegal header name .
• Illegal header value
• No valid payload input is entered.

AI-assisted analysis of google/tsunami-security-scanner@363ba87b35 (2026-09-13). Data as JSON: /api/errors/dfd7680822a5693f. Report an issue: GitHub.

Appendix: source

Thrown at plugin_server/py/common/data/network_service_utils.py:110

      service_context=ServiceContext(
          web_service_context=WebServiceContext(application_root=uri.path)
      )
  )


def build_web_application_root_url(network_service: NetworkService) -> str:
  """Build the root url for web application service.

  Args:
    network_service: network service protobuf with a valid service defined
    in the is_plain_http_by_known_web_service_name dict.

  Returns:
    The root URL for the web service which always ends with a "/"
    (i.e., http://localhost:8080/, https://127.1.23.1/pathway/)
  """
  if not is_web_service(network_service):
    raise ValueError("Invalid network service: %s" % network_service)
  return build_web_protocol(
      network_service) + build_web_uri_authority(
          network_service) + build_web_app_root_path(network_service)


def build_web_protocol(network_service: NetworkService) -> str:
  if is_plain_http_service(network_service):
    return "http://"
  else:
    return "https://"


def build_web_uri_authority(network_service: NetworkService) -> str:
  """Creates URI authority using the network service.

  The URI authority has 2 components: domain name and port number. Removes the
  port number from URI authority if the web service uses the standard default
  port. Port 80 for http/unsecure network and port 443 for https/secure

View on GitHub (pinned to 363ba87b35)