iflytek/astron-agent · warning · BusinessException

RESPONSE_FAILED

RESPONSE_FAILED

Error message

Only allowed schemes: ${props.getAllowedSchemes()}

What it means

The second, duplicated scheme check in validateUrlParam throws a generic RESPONSE_FAILED with message 'Only allowed schemes: <list>'. It is unreachable in practice for scheme violations because the identical if-condition on the previous lines already throws MODEL_URL_ILLEGAL_FAILED first.

Solutions

1. Fix the model URL to use an allowed scheme (see MODEL_URL_ILLEGAL_FAILED).
2. Remove the duplicate dead branch or change it to list allowed schemes for a more helpful message.
3. Align allowed-schemes config with the schemes actually used by model endpoints.

Example fix

// before (dead duplicate)
if (!SsrfValidators.isAllowedScheme(u.getProtocol(), props.getAllowedSchemes())) {
    throw new BusinessException(ResponseEnum.RESPONSE_FAILED, "Only allowed schemes: " + props.getAllowedSchemes());
}
// after
// delete the duplicate branch; the first check already rejects with MODEL_URL_ILLEGAL_FAILED

java.net.URI uri = java.net.URI.create(url);
Set<String> allowed = Set.of("http", "https");
boolean ok = uri.getScheme() != null && allowed.contains(uri.getScheme().toLowerCase());

try {
    ssrfParamGuard.validateUrlParam(url);
} catch (BusinessException e) {
    log.error("URL rejected: {}", e.getMessage());
    throw e;
}

When it happens

Trigger: Only if the first check were removed or refactored: same condition — u.getProtocol() not in props.getAllowedSchemes() during buildModelApiUrlNew/validateSsrfForNodes.

Common situations: Developers reading logs may see the duplicated guard and be confused which error surfaces; in current code this branch is dead code.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

• Skill resource URL is not allowed
• MODEL_URL_CHECK_FAILED
• MODEL_URL_CHECK_FAILED
• TOOLBOX_URL_HTTP_HTTPS_ONLY
• MODEL_URL_ILLEGAL_FAILED

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/7e9829f882e2d622. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/util/ssrf/SsrfParamGuard.java:60

     * <li>Check if the URL scheme (protocol) is allowed.</li>
     * <li>Check if the host is blocked by the configured IP blacklist (supporting both hostnames and
     * IPs).</li>
     * </ul>
     *
     * @param url the URL string to validate
     * @throws BusinessException if the URL does not pass validation
     */
    public void validateUrlParam(String url) {
        try {
            SsrfValidators.Normalized n = SsrfValidators.normalizeFlex(url);
            URL u = n.effectiveUrl;

            // 1) Protocol and port
            if (!SsrfValidators.isAllowedScheme(u.getProtocol(), props.getAllowedSchemes())) {
                throw new BusinessException(ResponseEnum.MODEL_URL_ILLEGAL_FAILED);
            }
            if (!SsrfValidators.isAllowedScheme(u.getProtocol(), props.getAllowedSchemes())) {
                throw new BusinessException(
                        ResponseEnum.RESPONSE_FAILED,
                        "Only allowed schemes: " + props.getAllowedSchemes());
            }

            // 2) IP blacklist (compatible with hostnames and IPs)
            List<String> ipBlacklist = props.getIpBlaklist();
            if (SsrfValidators.isHostDeniedByIpPolicy(
                    u.getHost(), ipBlacklist, props.getIpWhitelist(), Dns.SYSTEM)) {
                throw new BusinessException(ResponseEnum.MODEL_URL_CHECK_FAILED);
            }

        } catch (BusinessException e) {
            throw e;
        } catch (Exception e) {
            log.error("[SSRF] URL validation failed", e);
            throw new BusinessException(ResponseEnum.MODEL_URL_ILLEGAL_FAILED);
        }
    }

View on GitHub (pinned to 5e758547a8)