Leantime/leantime · error · \Exception

Refused to fetch iCal feed: URL failed SSRF safety check

Error message

Refused to fetch iCal feed: URL failed SSRF safety check

What it means

Error "Refused to fetch iCal feed: URL failed SSRF safety check" thrown in Leantime/leantime.

Source

Thrown at app/Domain/Calendar/Services/Calendar.php:866

    /**
     * Load an iCal URL and return its contents.
     *
     * Validates the URL against SSRF attacks before making the request.
     *
     * @param  string  $url  The URL of the iCal feed.
     * @return string The iCal content.
     *
     * @throws \Exception If the URL is unsafe or there is an error loading the URL.
     */
    public function loadIcalUrl(string $url): string
    {
        if (str_contains($url, 'webcal://')) {
            $url = str_replace('webcal://', 'https://', $url);
        }

        if (! OutboundUrlGuard::isAllowedUrl($url)) {
            throw new \Exception('Refused to fetch iCal feed: URL failed SSRF safety check');
        }

        $client = new \GuzzleHttp\Client;

        try {
            $response = $client->get($url, [
                'allow_redirects' => OutboundUrlGuard::redirectOptions(),
                'headers' => [
                    'Accept' => 'text/calendar',
                    'User-Agent' => 'Leantime Calendar Integration v'.$this->config->appVersion,
                ],
            ]);

            if ($response->getStatusCode() == 200) {
                return (string) $response->getBody();
            }

            throw new \Exception('Failed to load iCal feed: HTTP '.$response->getStatusCode());

View on GitHub (pinned to 9a9f49f100)

When it happens

Trigger: Thrown at app/Domain/Calendar/Services/Calendar.php:866 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Leantime/leantime@9a9f49f100 (2026-08-21). Data as JSON: /api/errors/8886971e063929dc. Report an issue: GitHub.