{"record":{"id":"65112147e4b0e85d","repo":"Pumpkin-MC/Pumpkin","slug":"invalid-url-domain-for-player-texture-0","errorCode":null,"errorMessage":"Invalid URL domain for player texture: {0}","messagePattern":"Invalid URL domain for player texture: (.+?)","errorType":"exception","errorClass":"TextureError","httpStatus":null,"severity":"error","filePath":"crates/pumpkin/src/net/authentication.rs","lineNumber":417,"sourceCode":"    #[error(\"You are banned from Authentication servers\")]\n    Banned,\n    #[error(\"Texture Error {0}\")]\n    TextureError(TextureError),\n    #[error(\"You have disallowed actions from Authentication servers\")]\n    DisallowedAction,\n    #[error(\"Failed to parse JSON into Game Profile\")]\n    FailedParse,\n    #[error(\"Unknown Status Code {0}\")]\n    UnknownStatusCode(StatusCode),\n}\n\n#[derive(Error, Debug)]\npub enum TextureError {\n    #[error(\"Invalid URL\")]\n    InvalidURL,\n    #[error(\"Invalid URL scheme for player texture: {0}\")]\n    DisallowedUrlScheme(String),\n    #[error(\"Invalid URL domain for player texture: {0}\")]\n    DisallowedUrlDomain(String),\n    #[error(\"Failed to decode base64 player texture: {0}\")]\n    DecodeError(String),\n    #[error(\"Failed to parse JSON from player texture: {0}\")]\n    JSONError(String),\n}\n\n#[cfg(test)]\nmod tests {\n    use super::ProfileTextures;\n\n    // Third-party auth servers (drasl, Blessing Skin, littleskin.cn) don't send\n    // `signatureRequired`. The profile must still parse. See issue #301.\n    #[test]\n    fn parses_profile_without_signature_required() {\n        let json = r#\"{\n            \"timestamp\": 0,\n            \"profileId\": \"069a79f444e94726a5befca90e38aaf5\",","sourceCodeStart":399,"sourceCodeEnd":435,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin/src/net/authentication.rs#L399-L435","documentation":"Fired during texture property validation when the URL's host is not on Minecraft's allowed texture domains (textures.minecraft.net, etc.). The bad domain is carried in the payload; it guards against SSRF-style redirects to arbitrary hosts.","triggerScenarios":"Thrown at crates/pumpkin/src/net/authentication.rs:417 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use the default skin when the domain is untrusted","Validate the host against Mojang's known texture domains before use","Log and skip the offending texture property"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}