{"record":{"id":"3613c1b024ca4a76","repo":"RocketChat/Rocket.Chat","slug":"invalid-href-value-provided","errorCode":null,"errorMessage":"Invalid href value provided","messagePattern":"Invalid href value provided","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/messages/sendMessage.ts","lineNumber":37,"sourceCode":"\tskipNotifications?: boolean;\n};\n\n// TODO: most of the types here are wrong, but I don't want to change them now\n\n/**\n * IMPORTANT\n *\n * This validator prevents malicious href values\n * intending to run arbitrary js code in anchor tags.\n * You should use it whenever the value you're checking\n * is going to be rendered in the href attribute of a\n * link.\n */\nconst validFullURLParam = Match.Where((value) => {\n\tcheck(value, String);\n\n\tif (!isAbsoluteURL(value) && !value.startsWith(FileUpload.getPath())) {\n\t\tthrow new Error('Invalid href value provided');\n\t}\n\n\tif (/^javascript:/i.test(value)) {\n\t\tthrow new Error('Invalid href value provided');\n\t}\n\n\treturn true;\n});\n\nconst validPartialURLParam = Match.Where((value) => {\n\tcheck(value, String);\n\n\tif (!isRelativeURL(value) && !isAbsoluteURL(value) && !value.startsWith(FileUpload.getPath())) {\n\t\tthrow new Error('Invalid href value provided');\n\t}\n\n\tif (/^javascript:/i.test(value)) {\n\t\tthrow new Error('Invalid href value provided');","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/messages/sendMessage.ts#L19-L55","documentation":"validFullURLParam (apps/meteor/server/lib/messages/sendMessage.ts:33-45) guards every URL-bearing attachment field (thumb_url, image_url, audio_url, video_url, title_link, author_link, author_icon, message_link, action url/image_url) during validateMessage. A value must satisfy isAbsoluteURL - which only accepts http://, https:// or data: (@rocket.chat/tools) - or start with the server's file-upload path (FileUpload.getPath()). Scheme-less or other-scheme values are rejected; the thrown plain Error is decorated with error.path naming the offending attachment field.","triggerScenarios":"Posting a message (chat.postMessage, DDP sendMessage, webhooks - they all run validateMessage) with attachments like image_url '//cdn.example.com/img.png' (protocol-relative), 'ftp://example.com/f' , 'example.com/img.png' (no scheme/slash), or a bare relative path not starting with the file-upload path.","commonSituations":"Integrations storing CDN links in protocol-relative form; generated attachments using non-http schemes (ftp, magnet, file); message templates with scheme-less hosts; content scraped from pages with relative image URLs.","solutions":["Use fully-qualified https:// URLs in all attachment URL fields","Convert protocol-relative '//host/path' links to 'https://host/path' before sending","For files hosted by Rocket.Chat itself, use the full URL returned by the upload API (it starts with the file-upload path and passes)","data: URIs are accepted where small inline content is intended"],"exampleFix":"// before: { attachments: [{ image_url: '//cdn.example.com/logo.png' }] } -> Invalid href value provided (path: image_url)\n// after: { attachments: [{ image_url: 'https://cdn.example.com/logo.png' }] }","handlingStrategy":"validation","validationCode":"import { isAbsoluteURL } from '@rocket.chat/tools';\n\nconst isFullHref = (v: string): boolean =>\n  isAbsoluteURL(v) || v.startsWith(FileUpload.getPath());\n\nconst fix = (v: string): string =>\n  v.startsWith('//') ? `https:${v}` : v; // repair protocol-relative links\n\nif (!isFullHref(fix(url))) throw new Error(`Invalid attachment URL: ${url}`);","typeGuard":"const isSafeFullHref = (value: string): value is string =>\n  typeof value === 'string' &&\n  (/^(https?:\\/\\/|data:)/.test(value) || value.startsWith(FileUpload.getPath())) &&\n  !/^javascript:/i.test(value);","tryCatchPattern":"try {\n  await sendMessage(user, message, room);\n} catch (error: any) {\n  if (error.message === 'Invalid href value provided') {\n    // error.path names the offending attachment field; fix it client-side\n    highlightAttachmentField(error.path);\n    return;\n  }\n  throw error;\n}","preventionTips":["Always send fully-qualified https:// URLs in attachment fields","Normalize protocol-relative '//host' links at ingest time","Run attachments through a URL validator before chat.postMessage"],"tags":["messages","attachments","url-validation","xss-guard","sendmessage"],"backgroundTag":"url-validation-failed","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}