larksuite/cli · error

download request URL is missing

Error message

download request URL is missing

What it means

pinDownloadRequestTargetToIP rewrites the outgoing download request so its host is the already-validated target IP. It throws this error when the request or its URL is nil, because there is no target to pin or validate. This is a defensive guard against a malformed request reaching the SSRF-pinning step.

Source

Thrown at internal/validate/url.go:386

		proxied:            proxied,
		lookupIP:           lookupIP,
		proxiedByTLSServer: make(map[string]*http.Transport),
	}, true
}

func cloneDownloadHTTPTransport(source *http.Transport) *http.Transport {
	cloned := source.Clone()
	if cloned.TLSNextProto == nil {
		if _, ok := source.TLSNextProto["h2"]; ok {
			cloned.ForceAttemptHTTP2 = true
		}
	}
	return cloned
}

func pinDownloadRequestTargetToIP(req *http.Request, targetIP net.IP) (*http.Request, error) {
	if req == nil || req.URL == nil {
		return nil, fmt.Errorf("download request URL is missing")
	}
	if targetIP == nil || isRestrictedDownloadIP(targetIP) {
		return nil, fmt.Errorf("blocked download target: local/internal host is not allowed")
	}

	originalHost := req.URL.Host
	pinnedHost := targetIP.String()
	if port := req.URL.Port(); port != "" {
		pinnedHost = net.JoinHostPort(pinnedHost, port)
	} else if strings.Contains(pinnedHost, ":") {
		pinnedHost = "[" + pinnedHost + "]"
	}

	pinned := req.Clone(req.Context())
	pinnedURL := *req.URL
	pinnedURL.Host = pinnedHost
	pinned.URL = &pinnedURL
	pinned.Host = originalHost

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Check the error from http.NewRequest before using the request
2. Ensure only fully-formed requests enter the download transport's RoundTrip
3. If building requests manually, always set req.URL
4. Audit middleware/transport wrappers that may drop the URL field

Example fix

// before
req, _ := http.NewRequestWithContext(ctx, "GET", rawURL, nil)
resp, err := client.Do(req)
// after
req, err := http.NewRequestWithContext(ctx, "GET", rawURL, nil)
if err != nil {
    return err
}
resp, err := client.Do(req)

func validRequest(req *http.Request) bool {
    return req != nil && req.URL != nil && req.URL.Scheme != ""
}
if !validRequest(req) { return fmt.Errorf("request and URL must be set before download") }

if req == nil || req.URL == nil { return nil, errors.New("download request URL is missing") }

if _, err := client.Do(req); err != nil && strings.Contains(err.Error(), "download request URL is missing") {
    return fmt.Errorf("malformed request reached download transport: %w", err)
}

When it happens

Trigger: RoundTrip passes a nil *http.Request, or a request constructed without a URL (e.g. http.NewRequest failed and its error was ignored, leaving a zero-value request).

Common situations: Ignoring the error from http.NewRequest and using the nil request; custom transport chains that strip or rebuild requests; tests feeding hand-built request structs directly into RoundTrip.

Related errors

• invalid content range: end %d is outside total %d
• official skills index exceeds %d bytes
• download proxy selection is missing
• nil connection
• missing remote address

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/dfb67ab5eaf5e915. Report an issue: GitHub.