{"record":{"id":"80dbf2145a639c9c","repo":"mozilla/pdf.js","slug":"a-valid-url-parameter-must-provided","errorCode":null,"errorMessage":"A valid \"url\" parameter must provided.","messagePattern":"A valid \"url\" parameter must provided\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"web/pdf_link_service.js","lineNumber":284,"sourceCode":"    try {\n      return await this.pdfDocument?.getAttachmentContent(id);\n    } catch (error) {\n      if (!(error instanceof PasswordException)) {\n        console.warn(`Unable to load attachment content: ${error}`);\n      }\n    }\n    return null;\n  }\n\n  /**\n   * Adds various attributes (href, title, target, rel) to hyperlinks.\n   * @param {HTMLAnchorElement} link\n   * @param {string} url\n   * @param {boolean} [newWindow]\n   */\n  addLinkAttributes(link, url, newWindow = false) {\n    if (!url || typeof url !== \"string\") {\n      throw new Error('A valid \"url\" parameter must provided.');\n    }\n    const target = newWindow ? LinkTarget.BLANK : this.externalLinkTarget,\n      rel = this.externalLinkRel;\n\n    // Strip userinfo (user:password@) from URLs used for display, to prevent\n    // phishing via hostname-spoofing (e.g. https://trusted.example@attacker.example/).\n    let displayUrl = url;\n    const parsedUrl = URL.parse(url);\n    if (parsedUrl?.username || parsedUrl?.password) {\n      parsedUrl.username = parsedUrl.password = \"\";\n      displayUrl = parsedUrl.href;\n    }\n\n    if (this.externalLinkEnabled) {\n      link.href = url;\n      link.title = displayUrl;\n    } else {\n      link.href = \"\";","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/mozilla/pdf.js/blob/5903d58d58e4dd9ce6ffa3834aea8480f06b4ada/web/pdf_link_service.js#L266-L302","documentation":"Thrown by PDFLinkService.addLinkAttributes when the url argument is falsy or not a string. The method decorates an <a> element (href, title, target, rel) and must be given a concrete URL string.","triggerScenarios":"Calling addLinkAttributes(link, undefined) or addLinkAttributes(link, 123, true). Also when a link annotation's URL field is empty/null and the outline/link viewer forwards it.","commonSituations":"PDF outline entries or link annotations with empty URI actions; calling addLinkAttributes before validating the parsed URL.","solutions":["Validate url is a non-empty string before calling addLinkAttributes.","Skip link decoration entirely when the annotation has no usable URL.","Sanitize link data from the PDF (e.g. outline items) before forwarding to the link service."],"exampleFix":"// before\nlinkService.addLinkAttributes(anchor, item.url, newWindow);\n\n// after\nif (typeof item.url === 'string' && item.url) {\n  linkService.addLinkAttributes(anchor, item.url, newWindow);\n}","handlingStrategy":"type-guard","validationCode":"if (typeof url === 'string' && url.trim() !== '') {\n  linkService.addLinkAttributes(link, url, newWindow);\n}","typeGuard":"function isNonEmptyString(v) {\n  return typeof v === 'string' && v.length > 0;\n}","tryCatchPattern":null,"preventionTips":["Validate URLs at the annotation/outline parsing boundary.","Skip decoration for empty URI actions.","Keep a shared URL-validation helper for link code."],"tags":["links","validation","annotations","url"],"backgroundTag":null,"analyzedSha":"5903d58d58e4dd9ce6ffa3834aea8480f06b4ada","analyzedAt":"2026-08-13T02:28:27.364Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}