unsafe-formatted-url-host-port

Detect URL and network-address construction that breaks IPv6.

Updated Aug 2, 2026View as Markdown

Default severity: warning

Formatting a URL authority or an address passed directly to a standard-library network listener as host:port does not add the brackets required around IPv6 literals. net.JoinHostPort correctly handles hostnames, IPv4, and IPv6.

Bad

url := fmt.Sprintf("http://%s:%d/path", host, port)

Good

address := net.JoinHostPort(host, strconv.Itoa(port)); url := "http://" + address