{"record":{"id":"1d941949ac862cd8","repo":"tinyhumansai/openhuman","slug":"url-cannot-contain-whitespace","errorCode":null,"errorMessage":"URL cannot contain whitespace","messagePattern":"URL cannot contain whitespace","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/openhuman/tools/impl/browser/browser_open.rs","lineNumber":29,"sourceCode":"}\n\nimpl BrowserOpenTool {\n    pub fn new(security: Arc<SecurityPolicy>, allowed_domains: Vec<String>) -> Self {\n        Self {\n            security,\n            allowed_domains: normalize_allowed_domains(allowed_domains),\n        }\n    }\n\n    fn validate_url(&self, raw_url: &str) -> anyhow::Result<String> {\n        let url = raw_url.trim();\n\n        if url.is_empty() {\n            anyhow::bail!(\"URL cannot be empty\");\n        }\n\n        if url.chars().any(char::is_whitespace) {\n            anyhow::bail!(\"URL cannot contain whitespace\");\n        }\n\n        if !url.starts_with(\"https://\") {\n            anyhow::bail!(\"Only https:// URLs are allowed\");\n        }\n\n        if self.allowed_domains.is_empty() {\n            anyhow::bail!(\n                \"Browser tool is enabled but no allowed_domains are configured. Add [browser].allowed_domains in config.toml\"\n            );\n        }\n\n        let host = extract_host(url)?;\n\n        if is_private_or_local_host(&host) {\n            anyhow::bail!(\"Blocked local/private host: {host}\");\n        }\n","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/749120085864ce16e0f273c7b86fac7740b39c5b/src/openhuman/tools/impl/browser/browser_open.rs#L11-L47","documentation":"validate_url rejects URLs containing any whitespace character. Whitespace in a URL passed to the OS opener can split arguments or enable scheme confusion at the shell/browser boundary, so such URLs are refused outright.","triggerScenarios":"Thrown at src/openhuman/tools/impl/browser/browser_open.rs:29 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Percent-encode spaces (%20) instead of embedding raw whitespace.","Trim or clean the URL at the source."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"749120085864ce16e0f273c7b86fac7740b39c5b","analyzedAt":"2026-08-17T21:21:45.363Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}