Hmbown/CodeWhale · error

outbound origin is empty or oversized

Error message

outbound origin is empty or oversized

What it means

validate_outbound_origin is the SSRF guard applied to credential-bearing outbound URLs (e.g. remote/cloud endpoints). This check rejects an origin that is empty after trimming or exceeds MAX_REMOTE_BYTES. It runs first, before URL parsing, so blank or absurdly long inputs fail with a clear message.

Solutions

  1. Set the remote origin env var (e.g. DAYTONA_API_URL) to a non-empty URL and re-run.
  2. Trim and check length before passing the origin; ensure config loaders do not feed empty strings through.
  3. Fix the config field holding an oversized value back to a normal origin string.

Example fix

// before
let url = validate_outbound_origin(&env_val).unwrap();
// after
let trimmed = env_val.trim();
anyhow::ensure!(!trimmed.is_empty(), "DAYTONA_API_URL must not be empty");
let url = validate_outbound_origin(trimmed)?;
Defensive patterns

Strategy: validation

Validate before calling

let raw = raw.trim();
if raw.is_empty() || raw.len() > 2048 { return Err("origin must be a non-empty, reasonably sized URL"); }

Try / catch

match validate_outbound_origin(raw) {
    Err(e) if e.to_string().contains("empty or oversized") => eprintln!("remote origin unset or invalid: {e}"),
    Err(e) => return Err(e),
    Ok(url) => url,
}

Prevention

When it happens

Trigger: Passing "", a whitespace-only string, or a URL longer than MAX_REMOTE_BYTES to validate_outbound_origin — e.g. an unset DAYTONA_API_URL / CWC_DAYTONA_ENDPOINT env var that was filtered to empty elsewhere, or a misconfigured toolbox_url.

Common situations: Missing remote-endpoint env var producing an empty string; pasting a URL with a trailing newline plus huge payload; config field accidentally set to the whole JSON blob.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/43664699a506b06e. Report an issue: GitHub.

Appendix: source

Thrown at crates/tui/src/cloud_dispatch.rs:1260

    pub patch: String,
}

/// Validate an outbound origin for credential-bearing HTTP calls.
///
/// Rules:
/// - `https` only for public hosts.
/// - explicit loopback hosts (`localhost`, `127.0.0.1`, `::1`) are allowed
///   only in debug builds, as the escape hatch for local smoke tests against
///   a self-hosted sandbox service; release builds reject them outright.
/// - the host must not be a private / link-local / reserved / multicast
///   address or a `.local` / `.internal` name, and no userinfo may ride
///   along.
///
/// DNS-resolved rebinding is out of scope and documented as such.
pub fn validate_outbound_origin(raw: &str) -> Result<reqwest::Url> {
    let trimmed = raw.trim();
    if trimmed.is_empty() || trimmed.len() > MAX_REMOTE_BYTES {
        bail!("outbound origin is empty or oversized");
    }
    let url = reqwest::Url::parse(trimmed).context("outbound origin is not a valid URL")?;
    if !matches!(url.scheme(), "http" | "https") {
        bail!("outbound origin must be http or https");
    }
    if !url.username().is_empty() || url.password().is_some() {
        bail!("outbound origin must not embed credentials");
    }
    let host = url
        .host_str()
        .context("outbound origin has no host")?
        .trim_end_matches('.')
        .to_ascii_lowercase();
    // `Url::host_str` keeps IPv6 brackets; strip them for the checks below.
    let host = host
        .strip_prefix('[')
        .and_then(|inner| inner.strip_suffix(']'))
        .map(str::to_string)

View on GitHub (pinned to 73e0f67d83)