{"record":{"id":"8f810be45d567502","repo":"toeverything/AFFiNE","slug":"invalid-embed-iframe-url-url","errorCode":null,"errorMessage":"Invalid embed iframe url: ${url}","messagePattern":"Invalid embed iframe url: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"blocksuite/affine/blocks/embed/src/embed-iframe-block/utils.ts","lineNumber":59,"sourceCode":"  try {\n    const parsedUrl = new URL(url);\n\n    const { protocols, hostnames } = options;\n    if (\n      parsedUrl.username ||\n      parsedUrl.password ||\n      parsedUrl.port ||\n      isLocalOrIpHostname(parsedUrl.hostname)\n    ) {\n      return false;\n    }\n\n    return (\n      protocols.includes(parsedUrl.protocol) &&\n      hostnames.includes(parsedUrl.hostname)\n    );\n  } catch (e) {\n    console.warn(`Invalid embed iframe url: ${url}`, e);\n    return false;\n  }\n}\n\n/**\n * Safely extracts the src URL from an iframe HTML string\n * @param htmlString The iframe HTML string to parse\n * @param options Optional validation configuration\n * @returns The validated src URL or undefined if validation fails\n */\nexport function safeGetIframeSrc(htmlString: string): string | undefined {\n  try {\n    // Create a DOMParser instance\n    const parser = new DOMParser();\n    // Parse the HTML string\n    const doc = parser.parseFromString(htmlString, 'text/html');\n    // Get the iframe element\n    const iframe = doc.querySelector('iframe');","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/toeverything/AFFiNE/blob/b4c8548c09da21b2898443559a5b846f0ccf5dd8/blocksuite/affine/blocks/embed/src/embed-iframe-block/utils.ts#L41-L77","documentation":"Warning logged in `validateEmbedIframeUrl` when `new URL(url)` throws on a malformed embed URL. Returns false, classifying the URL as invalid; the inputs at fault are embed src strings that are not syntactically valid URLs (and therefore cannot be safety-checked against allowed protocols/hostnames).","triggerScenarios":"Triggered when URL parsing throws while validating an embed iframe URL against allowed protocols and hostnames, causing validation to fail closed and return false.","commonSituations":"Occurs when a user enters an invalid or malformed URL in the embed iframe block. Enter a full https URL from a supported provider.","solutions":["Provide a valid, absolute embed iframe URL.","Validate the URL scheme before embedding."],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b4c8548c09da21b2898443559a5b846f0ccf5dd8","analyzedAt":"2026-08-18T21:16:52.546Z","contentChangedAt":"2026-08-18T21:16:52.546Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}