{"record":{"id":"88099563bb286355","repo":"microsoft/semantic-kernel","slug":"invalid-server-url-override-self-server-url-over","errorCode":null,"errorMessage":"Invalid server_url_override: {self.server_url_override}","messagePattern":"Invalid server_url_override: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/semantic_kernel/connectors/openapi_plugin/openapi_function_execution_parameters.py","lineNumber":79,"sourceCode":"        ),\n    )\n    allow_private_network_access: bool = Field(\n        False,\n        description=(\n            \"Whether OpenAPI operation requests may target private, loopback, link-local, or otherwise \"\n            \"non-public IP addresses. Disabled by default to prevent SSRF.\"\n        ),\n    )\n\n    def model_post_init(self, __context: Any) -> None:\n        \"\"\"Post initialization method for the model.\"\"\"\n        from semantic_kernel.connectors.openapi_plugin.server_url_validator import ServerUrlValidationOptions\n        from semantic_kernel.utils.telemetry.user_agent import HTTP_USER_AGENT\n\n        if self.server_url_override:\n            parsed_url = urlparse(self.server_url_override)\n            if not parsed_url.scheme or not parsed_url.netloc:\n                raise ValueError(f\"Invalid server_url_override: {self.server_url_override}\")\n\n        ServerUrlValidationOptions(allowed_base_urls=self.server_url_validation_allowed_base_urls)\n\n        if not self.user_agent:\n            self.user_agent = HTTP_USER_AGENT\n","sourceCodeStart":61,"sourceCodeEnd":85,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/connectors/openapi_plugin/openapi_function_execution_parameters.py#L61-L85","documentation":"`OpenAPIFunctionExecutionParameters.model_post_init` validates `server_url_override`: when it is non-empty it is run through `urlparse` and the code requires both a `scheme` and a `netloc`. A bare host, a path, or a typo'd URL (missing `http(s)://`) raises a raw `ValueError`. This guards the SSRF-prevention configuration surface before any request is sent.","triggerScenarios":"Constructing `OpenAPIFunctionExecutionParameters(server_url_override=...)` with a value like `\"example.com\"`, `\"localhost:8080\"`, `\"/api/v1\"`, or `\"ftp://x\"`-style fragments that lack a parseable scheme/netloc. Pydantic runs `model_post_init` at construction, so the error fires immediately on instantiation.","commonSituations":"Copy-pasting a base URL without the scheme; pulling a host from an env var that omits `https://`; switching from a config field that held just a hostname to one that expected a full URL; CI where the override is templated incorrectly.","solutions":["Provide a full absolute URL including scheme, e.g. `https://api.example.com`.","Normalize the value before passing it: `server_url_override = f\"https://{host}\"` if you only have a host.","Validate the env/config value with `urllib.parse.urlparse` in your own config loader and fail fast with a clearer message.","Leave `server_url_override` unset and rely on the spec's own `servers` block if you do not need to override."],"exampleFix":"# before\nparams = OpenAPIFunctionExecutionParameters(server_url_override=\"api.example.com\")  # raises 1483\n\n# after\nparams = OpenAPIFunctionExecutionParameters(server_url_override=\"https://api.example.com\")","handlingStrategy":"validation","validationCode":"from urllib.parse import urlparse\n\ndef normalize_server_url_override(value: str | None) -> str | None:\n    if not value:\n        return None\n    parsed = urlparse(value)\n    if not parsed.scheme or not parsed.netloc:\n        # add https:// if the user passed a bare host\n        if \".\" in value and \"://\" not in value:\n            return f\"https://{value}\"\n        raise ValueError(f\"server_url_override must be an absolute URL, got: {value!r}\")\n    return value\n\noverride = normalize_server_url_override(cfg.get(\"API_BASE\"))\nparams = OpenAPIFunctionExecutionParameters(server_url_override=override)","typeGuard":"from urllib.parse import urlparse\n\ndef is_absolute_url(value: str) -> bool:\n    p = urlparse(value)\n    return bool(p.scheme in (\"http\", \"https\") and p.netloc)","tryCatchPattern":"# model_post_init raises ValueError at construction time\ntry:\n    params = OpenAPIFunctionExecutionParameters(server_url_override=raw)\nexcept ValueError as e:\n    raise ConfigError(f\"Bad server_url_override: {raw!r} ({e})\") from e","preventionTips":["Always include the scheme in server URL config.","Validate URLs in your config loader, not at call time.","Unit-test your config normalization against host-only inputs.","Document that the field expects an absolute URL."],"tags":["openapi-plugin","config","ssrf","semantic-kernel"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}