{"record":{"id":"19e83db00f694c90","repo":"iflytek/astron-agent","slug":"toolbox-url-http-https-only","errorCode":"TOOLBOX_URL_HTTP_HTTPS_ONLY","errorMessage":"TOOLBOX_URL_HTTP_HTTPS_ONLY","messagePattern":"TOOLBOX_URL_HTTP_HTTPS_ONLY","errorType":"error_code","errorClass":"BusinessException","httpStatus":null,"severity":"error","filePath":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java","lineNumber":293,"sourceCode":"            if (SHORT_LINK_DOMAINS.contains(asciiDomain)) {\n                throw new BusinessException(ResponseEnum.TOOLBOX_URL_SHORT_NOT_SUPPORTED);\n            }\n        }\n    }\n\n    /**\n     * Only allows HTTP/HTTPS protocols. Silently returns on parsing exception, let upper layer handle\n     * uniformly.\n     *\n     * @param url the URL to validate protocol\n     * @throws BusinessException if protocol is not HTTP or HTTPS\n     */\n    public void checkHttpOrHttps(String url) {\n        try {\n            URL parsed = new URL(url);\n            String protocol = parsed.getProtocol();\n            if (!\"http\".equalsIgnoreCase(protocol) && !\"https\".equalsIgnoreCase(protocol)) {\n                throw new BusinessException(ResponseEnum.TOOLBOX_URL_HTTP_HTTPS_ONLY);\n            }\n        } catch (BusinessException e) {\n            throw e;\n        } catch (Exception ignore) {\n            // Let upper layer handle uniformly\n        }\n    }\n\n    /**\n     * Prohibits user information (user:pass@host) to avoid SSRF/phishing disguise. Original\n     * implementation was simple contains(\"@\"), here more precise: check URI's userInfo.\n     *\n     * @param url the URL to check for user information\n     * @throws BusinessException if URL contains user information\n     */\n    public void symbolCheck(String url) {\n        try {\n            URI uri = new URI(url);","sourceCodeStart":275,"sourceCodeEnd":311,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java#L275-L311","documentation":"UrlCheckTool.checkHttpOrHttps (UrlCheckTool.java:293) enforces that a URL's protocol is exactly http or https (case-insensitive). The toolbox URL validation throws TOOLBOX_URL_HTTP_HTTPS_ONLY when java.net.URL parses the string but its protocol is anything else (ftp:, file:, ws:, javascript:, etc.). This is part of the SSRF/safety policy applied before the platform calls user-supplied endpoints. Malformed strings that cannot be parsed are silently ignored here and handled later by checkUrl's catch-all.","triggerScenarios":"Calling checkHttpOrHttps(url) or checkUrl(url) with a URL whose parsed protocol is not http/https, e.g. \"ftp://example.com/file\", \"file:///etc/passwd\", \"ws://host\", or a protocol-relative or exotic-scheme string.","commonSituations":"Developers testing webhook/plugin URLs with file:// or custom scheme URIs; copying URLs from docs that use other schemes; users of the toolbox pasting non-HTTP endpoints into tool configuration; tests using protocol-relative URLs like \"//example.com\".","solutions":["Use an http:// or https:// URL including the explicit scheme prefix.","If the scheme is user-supplied, normalize it and reject non-http(s) schemes in your own UI before calling the API.","If you intended to allow other schemes, update the whitelist policy in the service layer rather than bypassing checkUrl."],"exampleFix":"// before\ncheckHttpOrHttps(\"ftp://example.com/file\"); // throws TOOLBOX_URL_HTTP_HTTPS_ONLY\n// after\ncheckHttpOrHttps(\"https://example.com/file\"); // passes","handlingStrategy":"validation","validationCode":"boolean isHttpOrHttps(String url) {\n    try {\n        String p = new java.net.URL(url).getProtocol();\n        return \"http\".equalsIgnoreCase(p) || \"https\".equalsIgnoreCase(p);\n    } catch (Exception e) {\n        return false;\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    urlCheckTool.checkUrl(url);\n} catch (BusinessException e) {\n    if (\"TOOLBOX_URL_HTTP_HTTPS_ONLY\".equals(e.getCode())) {\n        // show user: only http/https URLs are allowed\n    }\n}","preventionTips":["Always include an explicit http:// or https:// scheme when constructing URLs.","Reject or normalize non-http(s) schemes in your own input validation before calling the toolbox.","Never accept protocol-relative (//host) or scheme-less strings as endpoint URLs."],"tags":["url-validation","java","security","ssrf"],"backgroundTag":"invalid-url-format","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}