{"record":{"id":"21ef2c3ea1f3a42b","repo":"argoproj/argo-workflows","slug":"protocol-s-is-not-allowed","errorCode":null,"errorMessage":"protocol %s is not allowed","messagePattern":"protocol (.+?) is not allowed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/config.go","lineNumber":258,"sourceCode":"\treturn ResourceRateLimit{\n\t\tLimit: math.MaxFloat32,\n\t\tBurst: math.MaxInt32,\n\t}\n}\n\nfunc (c Config) GetPodGCDeleteDelayDuration() time.Duration {\n\tif c.PodGCDeleteDelayDuration == nil {\n\t\treturn 5 * time.Second\n\t}\n\n\treturn c.PodGCDeleteDelayDuration.Duration\n}\n\nfunc (c Config) ValidateProtocol(inputProtocol string, allowedProtocol []string) error {\n\tif slices.Contains(allowedProtocol, inputProtocol) {\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\"protocol %s is not allowed\", inputProtocol)\n}\n\nfunc (c *Config) Sanitize(allowedProtocol []string) error {\n\tlinks := c.Links\n\n\tfor _, link := range links {\n\t\t// We only validate user-supplied URL but not encode/decode it\n\t\t// see 2.4.2 on https://www.ietf.org/rfc/rfc2396.txt\n\t\tu, err := url.Parse(link.URL)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\terr = c.ValidateProtocol(u.Scheme, allowedProtocol)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil","sourceCodeStart":240,"sourceCodeEnd":276,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/config/config.go#L240-L276","documentation":"ValidateProtocol checks that a UI link's URL protocol is in the allowedProtocol list, returning this error when slices.Contains does not find it. It is invoked from Sanitize for each entry in the config's Links, guarding against unsafe or unintended schemes in admin-configured links.","triggerScenarios":"Config.Sanitize(allowedProtocol) encounters a c.Links entry whose URL scheme (e.g. http vs https, or javascript:) is not present in the allowed list passed by the controller config (`allowedLinkProtocol`).","commonSituations":"Admin adds a custom link using `http://` while only `https` is allowed; protocol list misconfigured or omitted in the controller configmap; upgrading Argo where stricter protocol validation was introduced.","solutions":["Change the link URL in the configmap to use an allowed protocol (usually https).","Add the desired protocol to `allowedLinkProtocol` in the workflow-controller-configmap and restart the controller.","Check the failing link entry named in the Sanitize context for hidden characters or missing scheme.","Read the controller logs to see which link triggered Sanitize failure and fix that specific entry."],"exampleFix":"// before (configmap)\n// links:\n//   - name: Admin\n//     url: http://internal.example.com\n// after\n// links:\n//   - name: Admin\n//     url: https://internal.example.com","handlingStrategy":"validation","validationCode":"// before applying the configmap\nlinks := cfg.Links\nfor _, l := range links {\n    u, _ := url.Parse(l.URL)\n    if !slices.Contains(allowedProtocols, u.Scheme) {\n        return fmt.Errorf(\"link %q uses disallowed protocol %q\", l.Name, u.Scheme)\n    }\n}","typeGuard":"func protocolAllowed(raw string, allowed []string) bool {\n    u, err := url.Parse(raw)\n    return err == nil && slices.Contains(allowed, u.Scheme)\n}","tryCatchPattern":"if err := cfg.Sanitize(allowedProtocols); err != nil {\n    return fmt.Errorf(\"controller config has a link with a disallowed protocol: %w\", err)\n}","preventionTips":["Use https:// for all admin-configured UI links.","Keep `allowedLinkProtocol` in the configmap aligned with the schemes you deploy.","Run `argo lint` / config validation before applying configmap changes.","Avoid scheme-less URLs; always specify the protocol explicitly."],"tags":["config","validation","security"],"backgroundTag":"protocol-not-allowed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}