{"record":{"id":"3977ee7b6d60759c","repo":"OpenBB-finance/OpenBB","slug":"invalid-url-provided-for-download-must-be-from-fe","errorCode":null,"errorMessage":"Invalid URL provided for download. Must be from federalreserve.gov -> {url}","messagePattern":"Invalid URL provided for download\\. Must be from federalreserve\\.gov -> (.+?)","errorType":"exception","errorClass":"OpenBBError","httpStatus":null,"severity":"error","filePath":"openbb_platform/providers/federal_reserve/openbb_federal_reserve/router.py","lineNumber":61,"sourceCode":"    \"\"\"\n    # pylint: disable=import-outside-toplevel\n    import base64  # noqa\n    from io import BytesIO\n    from urllib.parse import urlparse\n    from openbb_core.provider.utils.helpers import make_request\n\n    urls = params.get(\"url\", [])\n    results: list = []\n\n    for url in urls:\n        parsed_url = urlparse(url)\n        hostname = parsed_url.hostname or \"\"\n\n        if parsed_url.scheme != \"https\" or hostname not in {\n            \"www.federalreserve.gov\",\n            \"federalreserve.gov\",\n        }:\n            raise OpenBBError(\n                \"Invalid URL provided for download. Must be from federalreserve.gov -> \"\n                + url\n            )\n\n        is_pdf = url.lower().endswith(\".pdf\")\n\n        if (\n            not is_pdf\n            and not url.lower().endswith(\".htm\")\n            and not url.lower().endswith(\".html\")\n        ):\n            raise OpenBBError(\n                \"Unsupported document format. File must be PDF or HTM type -> \" + url\n            )\n\n        try:\n            response = make_request(url)\n            response.raise_for_status()","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/OpenBB-finance/OpenBB/blob/3e071fcc2cd9f891cac6040ae60296dba76dab46/openbb_platform/providers/federal_reserve/openbb_federal_reserve/router.py#L43-L79","documentation":"Raised by the federal_reserve router's document-download endpoint when a provided URL is not HTTPS or its hostname is not exactly www.federalreserve.gov / federalreserve.gov. This is a deliberate SSRF guard: the endpoint fetches and base64-encodes remote documents, so it whitelists a single origin.","triggerScenarios":"Passing url=['http://www.federalreserve.gov/...'] (http scheme), a www-less or different domain (e.g. federalreserve.gov.cdn.example.com), a URL with uppercase scheme/hostname parsing quirks, or a non-federalreserve.gov link such as a NY Fed document.","commonSituations":"Users pasting links from search results that point at mirror or archive domains; omitting the https:// scheme; trying to fetch fomcdocs from other sites through this router.","solutions":["Use the exact origin: https://www.federalreserve.gov/... (note urlparse hostname is case-insensitive here, but scheme must be lowercase https).","Ensure the URL string starts with 'https://' and contains no leading whitespace.","For documents on other domains, download them directly instead of via this router."],"exampleFix":"// before\nobb.federal_reserve.download(url=['http://federalreserve.gov/pub/pdf'])\n// after\nobb.federal_reserve.download(url=['https://www.federalreserve.gov/pub/pdf'])","handlingStrategy":"validation","validationCode":"from urllib.parse import urlparse\nassert urlparse(url).scheme == 'https' and urlparse(url).hostname in {'www.federalreserve.gov', 'federalreserve.gov'}, url","typeGuard":"def is_fed_gov_url(url: str) -> bool:\n    p = urlparse(url.strip())\n    return p.scheme == 'https' and (p.hostname or '').lower() in {'www.federalreserve.gov', 'federalreserve.gov'}","tryCatchPattern":null,"preventionTips":["Normalize URLs (strip whitespace, force https) before submitting","Only use this router for federalreserve.gov documents"],"tags":["openbb","url-validation","ssrf-guard","router"],"backgroundTag":null,"analyzedSha":"3e071fcc2cd9f891cac6040ae60296dba76dab46","analyzedAt":"2026-08-14T23:40:48.960Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}