jeecgboot/JeecgBoot · error · JeecgBootException

非法URL：主机名为空

Error message

非法URL：主机名为空

What it means

Thrown by checkSsrfHttpUrl when the parsed URI has a null or blank host — the URL contains a valid scheme but no resolvable hostname. Without a host, the SSRF target cannot be verified, so the method refuses to proceed.

Source

Thrown at jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/filter/SsrfFileTypeFilter.java:338

     * @param fileUrl HTTP(S) URL
     */
    public static void checkSsrfHttpUrl(String fileUrl) {
        if (StringUtils.isBlank(fileUrl)) {
            throw new JeecgBootException("非法URL：地址为空");
        }
        URI uri;
        try {
            uri = new URI(fileUrl);
        } catch (URISyntaxException e) {
            throw new JeecgBootException("非法URL：格式错误");
        }
        String scheme = uri.getScheme();
        if (scheme == null || !(scheme.equalsIgnoreCase("http") || scheme.equalsIgnoreCase("https"))) {
            throw new JeecgBootException("非法URL：仅允许 http / https 协议");
        }
        String host = uri.getHost();
        if (StringUtils.isBlank(host)) {
            throw new JeecgBootException("非法URL：主机名为空");
        }
        // 去掉 IPv6 的中括号
        if (host.startsWith("[") && host.endsWith("]")) {
            host = host.substring(1, host.length() - 1);
        }
        try {
            for (InetAddress addr : InetAddress.getAllByName(host)) {
                if (addr.isLoopbackAddress() || addr.isLinkLocalAddress()) {
                    throw new JeecgBootException("非法URL：禁止访问本机或链路本地地址 " + addr.getHostAddress());
                }
            }
        } catch (UnknownHostException e) {
            throw new JeecgBootException("非法URL：主机名无法解析");
        }
    }
    //update-end---author:zhangdaihao ---date:2026-04-15  for：【issues/9553】修复二次SSRF漏洞，对HTTP下载URL进行安全校验-----------

    /**

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Validate that the host portion of the URL is non-empty before calling checkSsrfHttpUrl.
2. Log the full URL at debug level when this error occurs to identify which caller constructs a hostless URL.
3. Add front-end validation requiring a complete URL with domain.
4. Check if a configuration property (e.g., MinIO endpoint, OSS host) is blank and causing the hostless URL.

Example fix

// before
String endpoint = minioConfig.getEndpoint(); // could be ""
String fileUrl = endpoint + "/" + objectKey; // "http:///bucket/key"
SsrfFileTypeFilter.checkSsrfHttpUrl(fileUrl);

// after
String endpoint = minioConfig.getEndpoint();
if (oConvertUtils.isEmpty(endpoint)) {
    throw new JeecgBootException("文件服务地址未配置");
}
String fileUrl = endpoint + "/" + objectKey;
SsrfFileTypeFilter.checkSsrfHttpUrl(fileUrl);

URI testUri = new URI(fileUrl);
if (oConvertUtils.isEmpty(testUri.getHost())) {
    return Result.error("URL缺少主机名");
}

try {
    SsrfFileTypeFilter.checkSsrfHttpUrl(fileUrl);
} catch (JeecgBootException e) {
    log.error("URL has no host: {}", fileUrl);
    return Result.error(e.getMessage());
}

When it happens

Trigger: URLs like 'http:///path' (triple slash, no host), 'http://:8080/path' (port but no host), 'http://' (scheme and // but empty host), or URLs where the host portion is all whitespace.

Common situations: Misconstructed URL from string concatenation where the host variable was empty (e.g., 'http://' + '' + '/api'); URL template placeholder for host was not filled; regex-based URL construction left host blank.

Related errors

• 非法URL：地址为空
• 非法URL：格式错误
• 非法URL：仅允许 http / https 协议
• 非法存储路径，路径包含遍历字符: {storePath}
• 请注意，值可能存在SQL注入风险!--->{value}

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/57e90831fee7226c. Report an issue: GitHub.