What causes "invalid request: " in siyuan-note/siyuan?

Use only standard methods: GET, POST, PUT, DELETE, PATCH (uppercase, no spaces)

invalid request:

Error message

invalid request:

What it means

http.NewRequest builds the outbound request; if it errors (unparseable URL at the request level, invalid method token, nil body misuse), the error is wrapped as 'invalid request: <cause>'. Unlike the earlier scheme/host checks, this catches deeper validation performed by net/http itself.

Source

Thrown at kernel/util/httprequest.go:327

		return 0, "", "", errors.New("URL has no host")
	}

	if serr := CheckHostSSRF(u.Hostname()); serr != nil {
		return 0, "", "", serr
	}

	method = strings.ToUpper(strings.TrimSpace(method))
	if method == "" {
		method = "GET"
	}

	var reqBody io.Reader
	if body != "" && method != "GET" && method != "HEAD" {
		reqBody = strings.NewReader(body)
	}
	req, err := http.NewRequest(method, rawURL, reqBody)
	if err != nil {
		return 0, "", "", errors.New("invalid request: " + err.Error())
	}
	for k, v := range headers {
		req.Header.Set(k, v)
	}

	resp, err := ssrfSafeClient.Do(req)
	if err != nil {
		return 0, "", "", errors.New("request failed: " + err.Error())
	}
	if resp == nil {
		return 0, "", "", errors.New("nil response")
	}
	defer resp.Body.Close()

	statusCode = resp.StatusCode
	contentType = resp.Header.Get("Content-Type")

	maxReadBytes := int64(maxHTTPRequestBytes)

View on GitHub (pinned to 8641553a1f)

Solutions

Use only standard methods: GET, POST, PUT, DELETE, PATCH (uppercase, no spaces)
Trim/validate the method string before calling HTTPRequest
Re-check the URL for illegal characters or malformed percent-encoding
Wrap the call and log err.Error() to see the precise net/http cause

Example fix

// before
HTTPRequest("get /v1", url, nil, "")
// after
HTTPRequest("GET", url, nil, "")

Defensive patterns

Strategy: try-catch

Validate before calling

validMethods := map[string]bool{"GET": true, "POST": true, "PUT": true, "DELETE": true, "PATCH": true}
if !validMethods[method] {
    return fmt.Errorf("unsupported method %q", method)
}

Type guard

func isStandardMethod(m string) bool {
    switch m {
    case "GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS":
        return true
    }
    return false
}

Try / catch

if _, _, _, err := HTTPRequest(method, url, nil, ""); err != nil {
    if strings.HasPrefix(err.Error(), "invalid request: ") {
        // log err.Error(): usually a bad method token or malformed URL
    }
    return err
}

Prevention

Restrict method input to a fixed whitelist of standard verbs
Trim and uppercase method strings from config/LLM output
Validate the full URL before passing it on
Log the wrapped net/http cause to pinpoint the invalid field

When it happens

Trigger: method not a valid HTTP token (e.g. contains lowercase-with-space or control chars), rawURL that url.Parse accepted earlier but NewRequest rejects, or an invalid body reader combination.

Common situations: LLM agents inventing custom methods (`GETS`, `DELETE /x`); method strings polluted with whitespace from config; method passed empty; URL with characters net/http refuses in the request line.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of siyuan-note/siyuan@8641553a1f (2026-09-11). Data as JSON: /api/errors/c3d7c801273db51a. Report an issue: GitHub.