iflytek/astron-agent · error · RemoteResourcePolicyError

Resolved remote resource address is invalid

Error message

Resolved remote resource address is invalid

What it means

socket_factory in safe_download.py implements SSRF protection: each DNS-resolved address is parsed with ipaddress.ip_address and then validated against the remote-resource policy (public addresses only, unless trusted storage is allowed). If the resolved address cannot be parsed as an IP, RemoteResourcePolicyError('Resolved remote resource address is invalid') is raised.

Solutions

1. Use a URL with a hostname that resolves to a standard IPv4/IPv6 public address
2. Inspect DNS resolution of the host (dig/nslookup) for malformed or non-IP sockaddrs
3. Restrict downloads to conventional public hostnames

import ipaddress, socket
infos = socket.getaddrinfo(host, None)
for i in infos:
    ipaddress.ip_address(i[4][0])  # must parse
    if not ipaddress.ip_address(i[4][0]).is_global:
        raise ValueError('non-public address')

def resolves_to_public_ip(host: str) -> bool:
    try:
        return all(ipaddress.ip_address(i[4][0]).is_global for i in socket.getaddrinfo(host, None))
    except (socket.gaierror, ValueError):
        return False

try:
    data = await fetch_public_resource(url)
except RemoteResourcePolicyError as e:
    logger.warning('download blocked: %s', e); data = None

When it happens

Trigger: fetch_public_resource() target URL resolves to a sockaddr whose first element is not a valid IP literal (e.g. unusual socket families like AF_UNIX, or malformed resolver output).

Common situations: DNS returning non-IPv4/IPv6 results, hostsfile/proxy oddities, or a URL whose host resolves through an exotic resolver (mDNS, .internal names).

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

• MODEL_URL_CHECK_FAILED
• HTTPClientError
• Remote resource address is unsafe
• Outbound address is blocked
• Outbound address is unsafe

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/b80a68e7e4d3a1c3. Report an issue: GitHub.

Appendix: source

Thrown at core/plugin/aitools/common/clients/safe_download.py:68

)


class RemoteResourcePolicyError(ValueError):
    """Raised when a caller-controlled download target is unsafe."""


def create_public_socket_factory(
    target_url: str,
) -> Callable[[aiohttp.AddrInfoType], socket.socket]:
    """Validate the actual address selected by aiohttp before opening its socket."""
    _, allow_private_storage = _validate_resource_url(target_url)

    def socket_factory(addr_info: aiohttp.AddrInfoType) -> socket.socket:
        family, type_, proto, _, sockaddr = addr_info
        try:
            address = ipaddress.ip_address(sockaddr[0])
        except ValueError as exc:
            raise RemoteResourcePolicyError(
                "Resolved remote resource address is invalid"
            ) from exc
        _validate_destination_address(
            address,
            allow_private_storage=allow_private_storage,
        )
        return socket.socket(family=family, type=type_, proto=proto)

    return socket_factory


async def fetch_public_resource(
    url: str,
    span: Optional[SpanLike] = None,
    *,
    max_bytes: int = DEFAULT_MAX_DOWNLOAD_BYTES,
) -> bytes:
    """Download a public or exact trusted-storage resource with SSRF checks."""

View on GitHub (pinned to 5e758547a8)