iflytek/astron-agent · error · BusinessException

RESPONSE_FAILED

RESPONSE_FAILED

Error message

Bad URL: ${e.getMessage()}

What it means

SsrfValidators.normalize re-encodes a parsed URL through URI to canonicalize it; if the re-encoded URL cannot be converted back (URISyntaxException), it throws RESPONSE_FAILED with 'Bad URL: <detail>'. This guards against malformed URLs before further SSRF checks.

Solutions

1. Read the URISyntaxException detail in the message to find the offending character/position.
2. Manually percent-encode illegal characters before passing the URL.
3. Correct IPv6 literal formatting (wrap in square brackets).
4. Normalize/trim the input string and re-test with new URI(url) locally to reproduce.

Example fix

// before
String url = "https://host:99999/path"; // port out of range
// after
String url = "https://host:8443/path";

function isValidHttpUrl(s) {
  try { const u = new URL(s.trim()); return u.protocol === 'https:' || u.protocol === 'http:'; }
  catch { return false; }
}

try {
    URL normalized = SsrfValidators.normalize(rawUrl);
} catch (BusinessException e) {
    log.error("Cannot normalize URL: {}", e.getMessage());
    throw e;
}

When it happens

Trigger: normalize(url) is given a string that parses as java.net.URL but produces an invalid URI during re-encoding — e.g. illegal characters in host, port out of range, or characters incompatible with the URI RFC after reconstruction.

Common situations: URLs copied with trailing whitespace/control characters, IPv6 literals malformed (missing brackets), percent-encoding mishandled, or ports like 'https://host:99999/path'.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• TOOLBOX_URL_ILLEGAL
• Only HTTP and HTTPS remote resources are allowed
• Remote resource URL must not include user information
• Outbound URL is malformed
• Outbound URL origin is invalid

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/d5534d5ab3923033. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/util/ssrf/SsrfValidators.java:168

        return false;
    }

    /**
     * Normalize a URL by removing encoding and fragment part.
     *
     * @param url original URL string
     * @return normalized URL
     * @throws MalformedURLException if URL format is invalid
     * @throws BusinessException if URI syntax is invalid
     */
    public static URL normalize(String url) throws MalformedURLException {
        URL u = new URL(url);
        try {
            URI uri = new URI(u.getProtocol(), u.getUserInfo(), u.getHost(), u.getPort(),
                    u.getPath(), u.getQuery(), null);
            return uri.normalize().toURL();
        } catch (URISyntaxException e) {
            throw new BusinessException(ResponseEnum.RESPONSE_FAILED, "Bad URL: " + e.getMessage());
        }
    }

    /**
     * Check whether the host hits the IP blacklist.
     *
     * <p>
     * Features:
     * </p>
     * <ul>
     * <li>Host can be domain or IP (IPv4/IPv6), domain resolves all A/AAAA records.</li>
     * <li>Blacklist supports both exact IP and CIDR (e.g., 192.168.0.0/16, fd00::/8).</li>
     * <li>IP canonicalization avoids misjudgment from different notations (::1, 0:0:0:0:0:0:0:1).</li>
     * <li>DNS resolution error is treated as "not hit".</li>
     * </ul>
     *
     * @param host target host (domain or IP, IPv6 can include [])
     * @param ipBlacklist blacklist entries (exact IP or CIDR)

View on GitHub (pinned to 5e758547a8)