iflytek/astron-agent · error · OutboundPolicyError

Invalid entry

Error message

Invalid {setting_name} entry

What it means

When loading the SSRF policy from environment (from_environment), IP/CIDR network lists are parsed with ipaddress.ip_network. Any comma-separated entry that is not a valid IP address or CIDR network raises OutboundPolicyError naming the offending setting (the message interpolates setting_name, e.g. 'Invalid IP_WHITE_LIST entry').

Solutions

  1. Convert each entry to a valid CIDR: use 10.0.0.0/24 form; a single IP like 10.0.0.1 is accepted as /32.
  2. Replace hyphen ranges with CIDR equivalents (10.0.0.1-10.0.0.5 → 10.0.0.0/29-style covering block, or list each IP).
  3. Verify each entry with python -c "import ipaddress; ipaddress.ip_network('ENTRY', strict=False)" before deploying.
  4. Domains belong in DOMAIN_BLACK_LIST, not the IP list — move them to the correct setting.

Example fix

// before
IP_WHITE_LIST=example.com,10.0.0.1-10.0.0.5
// after
IP_WHITE_LIST=10.0.0.1/32,10.0.0.2/31,10.0.0.4/31
DOMAIN_BLACK_LIST=example.com
Defensive patterns

Strategy: validation

Validate before calling

import ipaddress
def valid_cidr_list(raw: str) -> bool:
    for entry in raw.split(","):
        v = entry.strip()
        if not v:
            continue
        try:
            ipaddress.ip_network(v, strict=False)
        except ValueError:
            return False
    return True

Try / catch

try:
    policy = OutboundPolicy.from_environment()
except OutboundPolicyError as e:
    raise ConfigError(f"bad SSRF policy env: {e}") from e

Prevention

When it happens

Trigger: from_environment reads an env var whose comma-split entry fails ip_network(strict=False): a domain name (example.com) in an IP list, a hyphen range (10.0.0.1-10.0.0.5), a truncated address (10.0.0), a host:port token, or stray non-CIDR text.

Common situations: Ops pasting domain names into an IP allowlist; using Nginx-style ranges instead of CIDR; missing prefix like 10.0.0.0/8 written as 10.0.0.0; whitespace/typo corruption in deployed env files.

Understand the failure class

Background: "is not a valid" / "Invalid ... value" environment variable errors: how libraries validate env vars and what to do when they reject yours — this error's family across 48 libraries.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/b959767f302b1770. Report an issue: GitHub.

Appendix: source

Thrown at core/plugin/link/infra/tool_exector/ssrf_guard.py:224

        raise OutboundPolicyError("Outbound URL must not include user information")
    if "\\" in parsed.netloc:
        raise OutboundPolicyError("Outbound URL authority is invalid")
    if parsed.fragment:
        raise OutboundPolicyError("Outbound URL must not include a fragment")
    if port is not None and not 1 <= port <= 65535:
        raise OutboundPolicyError("Outbound URL port is invalid")


def _parse_networks(raw_value: str, setting_name: str) -> Tuple[IpNetwork, ...]:
    networks = []
    for entry in raw_value.split(","):
        value = entry.strip()
        if not value:
            continue
        try:
            networks.append(ipaddress.ip_network(value, strict=False))
        except ValueError as exc:
            raise OutboundPolicyError(f"Invalid {setting_name} entry") from exc
    return tuple(networks)


def _parse_domains(raw_value: str) -> Tuple[str, ...]:
    domains = []
    for entry in raw_value.split(","):
        value = entry.strip().lower().rstrip(".")
        if value.startswith("*."):
            value = value[2:]
        if value.startswith("."):
            value = value[1:]
        if not value:
            continue
        if "://" in value or "/" in value:
            raise OutboundPolicyError("Invalid DOMAIN_BLACK_LIST entry")
        try:
            # Use the same IDNA normalization as aiohttp/yarl applies to request hosts.
            # Python's built-in ``idna`` codec follows IDNA2003 and would otherwise

View on GitHub (pinned to 5e758547a8)