{"record":{"id":"19317df10e5f685e","repo":"tinyhumansai/openhuman","slug":"browser-tool-enabled-but-no-allowed-domains-config","errorCode":null,"errorMessage":"Browser tool enabled but no allowed_domains configured. Add [browser].allowed_domains in config.toml or set OPENHUMAN_BROWSER_ALLOW_ALL=1","messagePattern":"Browser tool enabled but no allowed_domains configured\\. Add \\[browser\\]\\.allowed_domains in config\\.toml or set OPENHUMAN_BROWSER_ALLOW_ALL=1","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/openhuman/tools/impl/browser/browser.rs","lineNumber":301,"sourceCode":"    fn validate_url(&self, url: &str) -> anyhow::Result<()> {\n        let url = url.trim();\n\n        if url.is_empty() {\n            anyhow::bail!(\"URL cannot be empty\");\n        }\n\n        // Block file:// URLs — browser file access bypasses all SSRF and\n        // domain-allowlist controls and can exfiltrate arbitrary local files.\n        if url.starts_with(\"file://\") {\n            anyhow::bail!(\"file:// URLs are not allowed in browser automation\");\n        }\n\n        if !url.starts_with(\"https://\") && !url.starts_with(\"http://\") {\n            anyhow::bail!(\"Only http:// and https:// URLs are allowed\");\n        }\n\n        if self.allowed_domains.is_empty() && !allow_all_browser_domains() {\n            anyhow::bail!(\n                \"Browser tool enabled but no allowed_domains configured. \\\n                Add [browser].allowed_domains in config.toml or set OPENHUMAN_BROWSER_ALLOW_ALL=1\"\n            );\n        }\n\n        let host = extract_host(url)?;\n\n        if is_private_host(&host) {\n            anyhow::bail!(\"Blocked local/private host: {host}\");\n        }\n\n        if !self.allowed_domains.is_empty() && !host_matches_allowlist(&host, &self.allowed_domains)\n        {\n            anyhow::bail!(\"Host '{host}' not in browser.allowed_domains\");\n        }\n\n        Ok(())\n    }","sourceCodeStart":283,"sourceCodeEnd":319,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/749120085864ce16e0f273c7b86fac7740b39c5b/src/openhuman/tools/impl/browser/browser.rs#L283-L319","documentation":"validate_url fails when the browser tool is enabled but [browser].allowed_domains is empty and the OPENHUMAN_BROWSER_ALLOW_ALL=1 escape hatch is not set. An empty allowlist would mean every navigation is out of policy, so the misconfiguration is reported before any navigation is attempted.","triggerScenarios":"Thrown at src/openhuman/tools/impl/browser/browser.rs:301 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add [browser].allowed_domains entries in config.toml.","Set OPENHUMAN_BROWSER_ALLOW_ALL=1 only if unrestricted browsing is intended."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"749120085864ce16e0f273c7b86fac7740b39c5b","analyzedAt":"2026-08-17T21:21:45.363Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}