{"record":{"id":"275e4eccdb6e64a1","repo":"diegosouzapw/OmniRoute","slug":"outbound-url-guard-blocked-275e4e","errorCode":"OUTBOUND_URL_GUARD_BLOCKED","errorMessage":"Blocked private or local provider URL","messagePattern":"Blocked private or local provider URL","errorType":"validation","errorClass":"OutboundUrlGuardError","httpStatus":null,"severity":"error","filePath":"src/shared/network/outboundUrlGuardPolicy.ts","lineNumber":117,"sourceCode":"  if (arePrivateProviderUrlsAllowed()) return \"none\";\n  if (areLocalProviderUrlsAllowed()) return \"block-metadata\";\n  return \"public-only\";\n}\n\n/**\n * Webhook variant of `parseAndValidatePublicUrl`. Webhooks legitimately point at\n * internal services (n8n, Home Assistant, a LAN box) in Docker/self-hosted deployments,\n * so the private-host block is gated behind the same explicit opt-in used for private\n * provider URLs (`OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`, default OFF). Protocol and\n * embedded-credential checks in `parseOutboundUrl` remain unconditional. (#3269)\n */\nexport function parseAndValidateWebhookUrl(input: string | URL) {\n  const url = parseOutboundUrl(input);\n\n  // Cloud-metadata / link-local endpoints are NEVER a valid webhook target — block them\n  // even when the private opt-in is enabled (SSRF→IAM-credential pivot). (#3269)\n  if (isCloudMetadataHost(url.hostname)) {\n    throw new OutboundUrlGuardError(PROVIDER_URL_BLOCKED_MESSAGE, {\n      code: \"OUTBOUND_URL_GUARD_BLOCKED\",\n      url: url.toString(),\n      hostname: url.hostname || null,\n    });\n  }\n\n  if (!arePrivateProviderUrlsAllowed() && isPrivateHost(url.hostname)) {\n    throw new OutboundUrlGuardError(PROVIDER_URL_BLOCKED_MESSAGE, {\n      code: \"OUTBOUND_URL_GUARD_BLOCKED\",\n      url: url.toString(),\n      hostname: url.hostname || null,\n    });\n  }\n\n  return url;\n}\n","sourceCodeStart":99,"sourceCodeEnd":134,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/shared/network/outboundUrlGuardPolicy.ts#L99-L134","documentation":"Error \"Blocked private or local provider URL\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/shared/network/outboundUrlGuardPolicy.ts:117 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}