HKUDS/nanobot · error · ValueError

unsafe media URL

Error message

unsafe media URL: {error}

What it means

In TelegramChannel.send(), a remote media item (http:// or https:// URL in msg.media) failed SSRF validation: validate_url_target(media_path) returned (False, error), so a ValueError is raised instead of handing the URL to the Telegram Bot API. This blocks server-side request forgery against internal networks via bot-sent media URLs; the URL at fault may resolve to a private/loopback/internal address or use a disallowed scheme.

Solutions

1. Send media from a public, resolvable HTTP(S) URL or upload local bytes instead
2. Add an explicitly approved host to the SSRF whitelist in tools.ssrf_whitelist if the target is intentionally internal
3. Download the media locally and send the file bytes rather than a URL

When it happens

Trigger: Thrown at nanobot/channels/telegram/runtime.py:961 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of HKUDS/nanobot@42f37dc4c0 (2026-08-26). Data as JSON: /api/errors/9c17530d6b1ad49f. Report an issue: GitHub.

Appendix: source

Thrown at nanobot/channels/telegram/runtime.py:961

                    "video": app.bot.send_video,
                    "voice": app.bot.send_voice,
                    "audio": app.bot.send_audio,
                }.get(media_type, app.bot.send_document)
                param = {
                    "photo": "photo",
                    "video": "video",
                    "voice": "voice",
                    "audio": "audio",
                }.get(media_type, "document")
                extra: dict[str, Any] = {}
                if media_type == "video":
                    extra["supports_streaming"] = True

                # Telegram Bot API accepts HTTP(S) URLs directly for media params.
                if self._is_remote_media_url(media_path):
                    ok, error = validate_url_target(media_path)
                    if not ok:
                        raise ValueError(f"unsafe media URL: {error}")
                    await self._call_with_retry(
                        sender,
                        chat_id=chat_id,
                        **{param: media_path},
                        reply_parameters=reply_params,
                        **thread_kwargs,
                        **extra,
                    )
                    continue

                media_bytes = Path(media_path).read_bytes()
                filename = Path(media_path).name
                send_kwargs = {param: media_bytes, "filename": filename}
                await self._call_with_retry(
                    sender,
                    chat_id=chat_id,
                    reply_parameters=reply_params,
                    **thread_kwargs,

View on GitHub (pinned to 42f37dc4c0)