HKUDS/nanobot · error · ImageGenerationError

blocked unsafe generated image URL

Error message

blocked unsafe generated image URL: {error}

What it means

SSRF protection in _download_image_data_url: resolve_url_target rejected the generated-image URL (or a redirect target) as unsafe — e.g. it points at a private/loopback/link-local address or a disallowed scheme. The embedded {error} names the specific violation. Prevents provider-supplied URLs from reaching internal networks; download aborts before any connection.

Solutions

1. Do not attempt to bypass the safety check; the URL targets a forbidden network location
2. Ask the provider for a normal public image URL and retry generation
3. If a proxy is configured, ensure the proxy itself can reach a legitimate public host

When it happens

Trigger: Thrown at nanobot/providers/image_generation.py:182 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of HKUDS/nanobot@42f37dc4c0 (2026-08-26). Data as JSON: /api/errors/3a58a2edf9d3eae5. Report an issue: GitHub.

Appendix: source

Thrown at nanobot/providers/image_generation.py:182

            "trust_env": False,
        }
        if proxy:
            # An explicit provider proxy is a user-selected trusted egress boundary.
            # Validate each URL locally, while the proxy owns final DNS resolution.
            client_kwargs["proxy"] = proxy
        else:
            client_kwargs["transport"] = PinnedDNSAsyncTransport(inner=transport)

        async with httpx.AsyncClient(**client_kwargs) as client:
            current_url = url
            for _ in range(_IMAGE_DOWNLOAD_MAX_REDIRECTS + 1):
                if proxy:
                    ok, error, _ = resolve_url_target(
                        current_url,
                        trust_remote_dns=True,
                    )
                    if not ok:
                        raise ImageGenerationError(
                            f"blocked unsafe generated image URL: {error}"
                        )
                async with client.stream("GET", current_url) as response:
                    if response.is_redirect:
                        location = response.headers.get("location")
                        if not location:
                            raise ImageGenerationError(
                                "generated image URL redirected without a location"
                            )
                        current_url = urljoin(str(response.url), location)
                        continue

                    try:
                        response.raise_for_status()
                    except httpx.HTTPStatusError as exc:
                        raise ImageGenerationError(
                            f"failed to download generated image (HTTP {response.status_code})"
                        ) from exc

View on GitHub (pinned to 42f37dc4c0)