{"record":{"id":"7b4ea1f8b2f0fc2c","repo":"flarum/framework","slug":"provided-avatar-url-must-have-scheme-http-or-https-scheme","errorCode":null,"errorMessage":"Provided avatar URL must have scheme http or https. Scheme provided was $scheme.","messagePattern":"Provided avatar URL must have scheme http or https\\. Scheme provided was \\$scheme\\.","errorType":"validation","errorClass":"ValidationException","httpStatus":422,"severity":"error","filePath":"framework/core/src/Api/Resource/UserResource.php","lineNumber":519,"sourceCode":"    /**\n     * @throws ValidationException\n     */\n    private function assertValidAvatarUrl(string $url): void\n    {\n        $urlValidator = $this->validation->make(compact('url'), [\n            'url' => 'required|active_url',\n        ]);\n\n        if ($urlValidator->fails()) {\n            throw new ValidationException([\n                'avatar_url' => 'Provided avatar URL must be a valid URI.',\n            ]);\n        }\n\n        $scheme = parse_url($url, PHP_URL_SCHEME);\n\n        if (! in_array($scheme, ['http', 'https'])) {\n            throw new ValidationException([\n                'avatar_url' => \"Provided avatar URL must have scheme http or https. Scheme provided was $scheme.\",\n            ]);\n        }\n    }\n\n    private function readAvatarFromUrl(string $url): ?\\Intervention\\Image\\Interfaces\\ImageInterface\n    {\n        $contents = $this->retrieveAvatarFromUrl($url);\n\n        if ($contents === null || ! $this->withinMaxResolution($contents)) {\n            return null;\n        }\n\n        return $this->imageManager->read($contents);\n    }\n\n    private function retrieveAvatarFromUrl(string $url): ?string\n    {","sourceCodeStart":501,"sourceCodeEnd":537,"githubUrl":"https://github.com/flarum/framework/blob/4b939f685389bfe8a380e9e28ddf305a1c66950c/framework/core/src/Api/Resource/UserResource.php#L501-L537","documentation":"Second guard in UserResource::assertValidAvatarUrl: the URL passed active_url validation but parse_url reports a scheme other than http or https (e.g. file:, ftp:, data:). Only http/https remote images may be fetched for avatar processing, so the request is rejected to prevent fetching from disallowed schemes (SSRF-style protection).","triggerScenarios":"Thrown at framework/core/src/Api/Resource/UserResource.php:519 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide the avatar URL with an explicit http:// or https:// scheme","Do not use file://, ftp://, data: or other scheme URLs for remote avatar upload","Keep client-side URL validation consistent by requiring http(s) before submitting"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4b939f685389bfe8a380e9e28ddf305a1c66950c","analyzedAt":"2026-09-15T18:09:20.879Z","contentChangedAt":"2026-09-15T18:09:20.879Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}