{"record":{"id":"4b97d43ad901582f","repo":"tinyhumansai/openhuman","slug":"url-port-is-out-of-range","errorCode":null,"errorMessage":"URL port is out of range","messagePattern":"URL port is out of range","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/openhuman/tools/impl/network/url_guard.rs","lineNumber":280,"sourceCode":"        .or_else(|| url.strip_prefix(\"https://\"))\n        .ok_or_else(|| anyhow::anyhow!(\"Only http:// and https:// URLs are allowed\"))?;\n\n    let authority = rest\n        .split(['/', '?', '#'])\n        .next()\n        .ok_or_else(|| anyhow::anyhow!(\"Invalid URL\"))?;\n\n    if authority.starts_with('[') {\n        anyhow::bail!(\"IPv6 hosts are not supported in http_request\");\n    }\n\n    if let Some((_, port)) = authority.rsplit_once(':') {\n        if port.is_empty() || !port.chars().all(|ch| ch.is_ascii_digit()) {\n            anyhow::bail!(\"URL port must be numeric\");\n        }\n        return port\n            .parse::<u16>()\n            .map_err(|_| anyhow::anyhow!(\"URL port is out of range\"));\n    }\n\n    Ok(if is_http { 80 } else { 443 })\n}\n\npub(super) fn host_matches_allowlist(host: &str, allowed_domains: &[String]) -> bool {\n    allowed_domains.iter().any(|domain| {\n        // `\"*\"` is the explicit allow-all wildcard (the \"Allow all sites\"\n        // toggle), mirroring the browser tool. Local/private hosts are still\n        // rejected upstream by `is_private_or_local_host`, so a wildcard only\n        // opens *public* hosts, never the loopback/RFC1918 SSRF surface.\n        domain == \"*\"\n            || host == domain\n            || host\n                .strip_suffix(domain)\n                .is_some_and(|prefix| prefix.ends_with('.'))\n    })\n}","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/749120085864ce16e0f273c7b86fac7740b39c5b/src/openhuman/tools/impl/network/url_guard.rs#L262-L298","documentation":"While parsing the URL authority, extract_port rejects port components containing non-ASCII-digit characters (e.g. ':8080x' or a trailing colon) or values that fail u16 parsing — a malformed-URL guard inside the SSRF validator, hit before any DNS check or request.","triggerScenarios":"Thrown at src/openhuman/tools/impl/network/url_guard.rs:280 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove or fix the port so it is a bare numeric value in 0-65535","Omit the port to use the scheme default"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"749120085864ce16e0f273c7b86fac7740b39c5b","analyzedAt":"2026-08-17T21:21:45.363Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}