{"record":{"id":"0a1b14245b10afad","repo":"diegosouzapw/OmniRoute","slug":"outbound-url-invalid","errorCode":"OUTBOUND_URL_INVALID","errorMessage":"Invalid outbound URL: ${String(input)}","messagePattern":"Invalid outbound URL: (.+?)","errorType":"validation","errorClass":"OutboundUrlGuardError","httpStatus":null,"severity":"error","filePath":"src/shared/network/outboundUrlGuard.ts","lineNumber":89,"sourceCode":" * SSRF→IAM-credential pivot and have no legitimate webhook/automation use case. They are\n * blocked UNCONDITIONALLY — even when private targets are explicitly opted in. (#3269)\n */\nexport function isCloudMetadataHost(hostname: string): boolean {\n  const host = normalizeHost(hostname);\n  if (!host) return false;\n  if (isCloudMetadataIpv4(host)) return true;\n  // An IPv4-mapped IPv6 literal routes to the embedded IPv4 address, so the same\n  // verdict has to apply to it — otherwise this block is spelling-sensitive.\n  const mapped = mappedIpv4Host(host);\n  return mapped !== null && isCloudMetadataIpv4(mapped);\n}\n\nexport function parseOutboundUrl(input: string | URL) {\n  let url: URL;\n  try {\n    url = input instanceof URL ? input : new URL(String(input));\n  } catch {\n    throw new OutboundUrlGuardError(`Invalid outbound URL: ${String(input)}`, {\n      code: \"OUTBOUND_URL_INVALID\",\n      url: String(input),\n    });\n  }\n\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new OutboundUrlGuardError(`Invalid outbound URL protocol for ${url.toString()}`, {\n      code: \"OUTBOUND_URL_INVALID\",\n      url: url.toString(),\n      hostname: url.hostname || null,\n    });\n  }\n\n  if (url.username || url.password) {\n    throw new OutboundUrlGuardError(\"Blocked outbound URL with embedded credentials\", {\n      code: \"OUTBOUND_URL_GUARD_BLOCKED\",\n      url: url.toString(),\n      hostname: url.hostname || null,","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/shared/network/outboundUrlGuard.ts#L71-L107","documentation":"Error \"Invalid outbound URL: ${String(input)}\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/shared/network/outboundUrlGuard.ts:89 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}