RocketChat/Rocket.Chat · error · Error

Invalid href value provided

Error message

Invalid href value provided

What it means

validFullURLParam (apps/meteor/server/lib/messages/sendMessage.ts:33-45) guards every URL-bearing attachment field (thumb_url, image_url, audio_url, video_url, title_link, author_link, author_icon, message_link, action url/image_url) during validateMessage. A value must satisfy isAbsoluteURL - which only accepts http://, https:// or data: (@rocket.chat/tools) - or start with the server's file-upload path (FileUpload.getPath()). Scheme-less or other-scheme values are rejected; the thrown plain Error is decorated with error.path naming the offending attachment field.

Source

Thrown at apps/meteor/server/lib/messages/sendMessage.ts:37

	skipNotifications?: boolean;
};

// TODO: most of the types here are wrong, but I don't want to change them now

/**
 * IMPORTANT
 *
 * This validator prevents malicious href values
 * intending to run arbitrary js code in anchor tags.
 * You should use it whenever the value you're checking
 * is going to be rendered in the href attribute of a
 * link.
 */
const validFullURLParam = Match.Where((value) => {
	check(value, String);

	if (!isAbsoluteURL(value) && !value.startsWith(FileUpload.getPath())) {
		throw new Error('Invalid href value provided');
	}

	if (/^javascript:/i.test(value)) {
		throw new Error('Invalid href value provided');
	}

	return true;
});

const validPartialURLParam = Match.Where((value) => {
	check(value, String);

	if (!isRelativeURL(value) && !isAbsoluteURL(value) && !value.startsWith(FileUpload.getPath())) {
		throw new Error('Invalid href value provided');
	}

	if (/^javascript:/i.test(value)) {
		throw new Error('Invalid href value provided');

View on GitHub (pinned to b2c16d5842)

Solutions

1. Use fully-qualified https:// URLs in all attachment URL fields
2. Convert protocol-relative '//host/path' links to 'https://host/path' before sending
3. For files hosted by Rocket.Chat itself, use the full URL returned by the upload API (it starts with the file-upload path and passes)
4. data: URIs are accepted where small inline content is intended

Example fix

// before: { attachments: [{ image_url: '//cdn.example.com/logo.png' }] } -> Invalid href value provided (path: image_url)
// after: { attachments: [{ image_url: 'https://cdn.example.com/logo.png' }] }

import { isAbsoluteURL } from '@rocket.chat/tools';

const isFullHref = (v: string): boolean =>
  isAbsoluteURL(v) || v.startsWith(FileUpload.getPath());

const fix = (v: string): string =>
  v.startsWith('//') ? `https:${v}` : v; // repair protocol-relative links

if (!isFullHref(fix(url))) throw new Error(`Invalid attachment URL: ${url}`);

const isSafeFullHref = (value: string): value is string =>
  typeof value === 'string' &&
  (/^(https?:\/\/|data:)/.test(value) || value.startsWith(FileUpload.getPath())) &&
  !/^javascript:/i.test(value);

try {
  await sendMessage(user, message, room);
} catch (error: any) {
  if (error.message === 'Invalid href value provided') {
    // error.path names the offending attachment field; fix it client-side
    highlightAttachmentField(error.path);
    return;
  }
  throw error;
}

When it happens

Trigger: Posting a message (chat.postMessage, DDP sendMessage, webhooks - they all run validateMessage) with attachments like image_url '//cdn.example.com/img.png' (protocol-relative), 'ftp://example.com/f' , 'example.com/img.png' (no scheme/slash), or a bare relative path not starting with the file-upload path.

Common situations: Integrations storing CDN links in protocol-relative form; generated attachments using non-http schemes (ftp, magnet, file); message templates with scheme-less hosts; content scraped from pages with relative image URLs.

Related errors

• Invalid Slash Command parameter provided, it must be a valid
• Message converter not found
• error-invalid-actionlink
• error-pinning-message
• restricted-workspace

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/3613c1b024ca4a76. Report an issue: GitHub.