iflytek/astron-agent · error · BusinessException

MODEL_URL_CHECK_FAILED

MODEL_URL_CHECK_FAILED

Error message

BusinessException(ResponseEnum.MODEL_URL_CHECK_FAILED)

What it means

MODEL_URL_CHECK_FAILED is thrown by buildModelApiUrlNew during SSRF-safe URL construction. After stripping userInfo and normalizing the base URL, any query string (?key=value) or fragment present is rejected outright, because query parts are used to smuggle credentials or bypass SSRF checks.

Solutions

1. Remove the query string and fragment from the endpoint URL; keep only scheme://host/path.
2. If an API key was passed as a query parameter, configure it in the API key field instead of the URL.
3. For Azure-style api-version requirements, put the parameter in the provider's payload/config handling rather than the saved endpoint.
4. Re-save the model and re-run validation.

Example fix

// before
endpoint = "https://generativelanguage.googleapis.com/v1beta/models?key=AIza...";
// after
endpoint = "https://generativelanguage.googleapis.com/v1beta/models"; // key goes in apiKey field

java.net.URI u = java.net.URI.create(endpoint);
if (u.getQuery() != null || u.getFragment() != null) throw new IllegalArgumentException("endpoint must not contain query or fragment: " + endpoint);

boolean isCleanUrl(String s) { try { java.net.URI u = java.net.URI.create(s); return u.getScheme() != null && u.getHost() != null && u.getQuery() == null && u.getFragment() == null; } catch (Exception e) { return false; } }

try { modelService.validateModel(req); } catch (BusinessException e) { if ("MODEL_URL_CHECK_FAILED".equals(e.getCode())) { promptUserToStripQueryAndFragment(); } throw e; }

When it happens

Trigger: Saving/validating a model whose endpoint baseUrl includes a query string (e.g. https://api.example.com/v1?x=1) or a fragment (#frag) — normalize() keeps the query and the guard at line ~268 throws.

Common situations: User pastes a full URL copied from a browser address bar that includes ?key=... or tracking parameters; provider docs show URLs with query params like ?api-version=2024-02-01 (Azure style).

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• Skill resource URL is not allowed
• MODEL_URL_CHECK_FAILED
• TOOLBOX_URL_HTTP_HTTPS_ONLY
• MODEL_URL_ILLEGAL_FAILED
• RESPONSE_FAILED

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/63a25b5790a9c619. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/model/ModelService.java:268

     * path; dual validation for entry and final URL.
     */
    private String buildModelApiUrlNew(String baseUrl, String provider, String modelDomain) {
        try {
            List<String> ipBlacklist = loadIpRules(CAT_IP_BLACKLIST);
            List<String> ipWhitelist = loadIpRules(CAT_IP_WHITELIST);
            SsrfProperties ssrfProperties = new SsrfProperties();
            // Note: The underlying object field name is ipBlaklist (third-party spelling), maintain
            // compatibility
            ssrfProperties.setIpBlaklist(ipBlacklist);
            ssrfProperties.setIpWhitelist(ipWhitelist);

            // 0) Remove userInfo and normalize
            String stripped = SsrfValidators.stripUserInfo(baseUrl);
            URL normalized = SsrfValidators.normalize(stripped);

            // 1) Prohibit query/fragment
            if (normalized.getQuery() != null) {
                throw new BusinessException(ResponseEnum.MODEL_URL_CHECK_FAILED);
            }

            SsrfParamGuard guard = new SsrfParamGuard(ssrfProperties);

            // 2) Only do pre-validation on host segment
            String hostOnly =
                    normalized.getProtocol()
                            + "://"
                            + normalized.getHost()
                            + (normalized.getPort() != -1 ? (":" + normalized.getPort()) : "");
            guard.validateUrlParam(hostOnly);

            // 3) Path completion
            String path = Optional.ofNullable(normalized.getPath()).orElse("");
            String cleanedPath = path.replaceAll("/+$", "");
            String finalPath = completeApiPath(cleanedPath, provider, modelDomain);

            // SECURITY FIX: Validate path to prevent directory traversal

View on GitHub (pinned to 5e758547a8)