{"record":{"id":"5e1cc303df006e30","repo":"modelcontextprotocol/servers","slug":"unsupported-url-protocol-for-datauri-only-http","errorCode":null,"errorMessage":"Unsupported URL protocol for ${dataUri}. Only http, https, and data URLs are supported.","messagePattern":"Unsupported URL protocol for (.+?)\\. Only http, https, and data URLs are supported\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/everything/tools/gzip-file-as-resource.ts","lineNumber":144,"sourceCode":"};\n\n/**\n * Validates a given data URI to ensure it follows the appropriate protocols and rules.\n *\n * @param {string} dataUri - The data URI to validate. Must be an HTTP, HTTPS, or data protocol URL. If a domain is provided, it must match the allowed domains list if applicable.\n * @return {URL} The validated and parsed URL object.\n * @throws {Error} If the data URI does not use a supported protocol or does not meet allowed domains criteria.\n */\nfunction validateDataURI(dataUri: string): URL {\n  // Validate Inputs\n  const url = new URL(dataUri);\n  try {\n    if (\n      url.protocol !== \"http:\" &&\n      url.protocol !== \"https:\" &&\n      url.protocol !== \"data:\"\n    ) {\n      throw new Error(\n        `Unsupported URL protocol for ${dataUri}. Only http, https, and data URLs are supported.`\n      );\n    }\n    if (\n      GZIP_ALLOWED_DOMAINS.length > 0 &&\n      (url.protocol === \"http:\" || url.protocol === \"https:\")\n    ) {\n      const domain = url.hostname;\n      const domainAllowed = GZIP_ALLOWED_DOMAINS.some((allowedDomain) => {\n        return domain === allowedDomain || domain.endsWith(`.${allowedDomain}`);\n      });\n      if (!domainAllowed) {\n        throw new Error(`Domain ${domain} is not in the allowed domains list.`);\n      }\n    }\n  } catch (error) {\n    throw new Error(\n      `Error processing file ${dataUri}: ${","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/modelcontextprotocol/servers/blob/76d64c822f5125032f89eb71dbdb94e42b434821/src/everything/tools/gzip-file-as-resource.ts#L126-L162","documentation":"Thrown by `validateDataURI` when the parsed URL's protocol is not `http:`, `https:`, or `data:`. This guards the gzip tool against fetching from unsupported schemes (e.g. `file://`, `ftp://`) which `fetch()` may reject or, worse, resolve to local resources.","triggerScenarios":"Calling `gzip-file-as-resource` with a `data` argument whose URL uses an unsupported scheme — e.g. `file:///etc/passwd`, `ftp://host/file`, `javascript:...`, or a malformed string that `new URL()` still parses into an unexpected protocol.","commonSituations":"Users pointing the tool at a local file path (`file://`), copy-pasting an `ftp://` link, or a malicious/erroneous `data:` URI whose scheme parsing yields something unexpected. Also triggered by relative URLs resolved against an unintended base.","solutions":["Use an `http://` or `https://` URL, or a well-formed `data:` URI for the `data` argument.","For local files, host them over http or inline them as a `data:` URI (base64).","Validate the protocol client-side before calling the tool: `['http:','https:','data:'].includes(new URL(u).protocol)`."],"exampleFix":"// before\ntoolHandler({ data: 'file:///tmp/big.txt' });\n// after\ntoolHandler({ data: 'https://example.com/big.txt' });","handlingStrategy":"validation","validationCode":"function isSupportedFetchUrl(s: string): boolean {\n  try {\n    const p = new URL(s).protocol;\n    return p === 'http:' || p === 'https:' || p === 'data:';\n  } catch { return false; }\n}\nif (!isSupportedFetchUrl(args.data)) { /* surface error */ }","typeGuard":"function isHttpDataUrl(s: string): boolean {\n  return /^(https?:|data:)/i.test(s);\n}","tryCatchPattern":null,"preventionTips":["Use http(s) or data: URIs only; never file:// or ftp://.","For local files, serve over http or inline as a data: URI.","Validate the protocol client-side before calling the tool."],"tags":["mcp","typescript","validation","everything-server","network","security","url"],"backgroundTag":null,"analyzedSha":"76d64c822f5125032f89eb71dbdb94e42b434821","analyzedAt":"2026-08-12T10:02:41.718Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}