{"record":{"id":"92a09fa63c5f62d7","repo":"zeroclaw-labs/zeroclaw","slug":"file-urls-are-not-allowed-in-browser-automation","errorCode":null,"errorMessage":"file:// URLs are not allowed in browser automation","messagePattern":"file:// URLs are not allowed in browser automation","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/browser.rs","lineNumber":448,"sourceCode":"                anyhow::bail!(\n                    \"browser.backend='auto' needs agent-browser CLI, browser-native, or computer-use sidecar\"\n                )\n            }\n        }\n    }\n\n    /// Validate URL against allowlist\n    fn validate_url(&self, url: &str) -> anyhow::Result<()> {\n        let url = url.trim();\n\n        if url.is_empty() {\n            anyhow::bail!(\"URL cannot be empty\");\n        }\n\n        // Block file:// URLs — browser file access bypasses all SSRF and\n        // domain-allowlist controls and can exfiltrate arbitrary local files.\n        if url.starts_with(\"file://\") {\n            anyhow::bail!(\"file:// URLs are not allowed in browser automation\");\n        }\n\n        if !url.starts_with(\"https://\") && !url.starts_with(\"http://\") {\n            anyhow::bail!(\"Only http:// and https:// URLs are allowed\");\n        }\n\n        let parsed = reqwest::Url::parse(url)\n            .map_err(|e| anyhow::Error::msg(format!(\"Invalid URL format: {e}\")))?;\n\n        if !parsed.username().is_empty() || parsed.password().is_some() {\n            anyhow::bail!(\"URL userinfo is not allowed\");\n        }\n\n        if self.allowed_domains.is_empty() && self.allowed_private_hosts.is_empty() {\n            anyhow::bail!(\n                \"Browser tool enabled but no allowed_domains configured. \\\n                Add [browser].allowed_domains in config.toml\"\n            );","sourceCodeStart":430,"sourceCodeEnd":466,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/browser.rs#L430-L466","documentation":"Error \"file:// URLs are not allowed in browser automation\" thrown in zeroclaw-labs/zeroclaw.","triggerScenarios":"Thrown at crates/zeroclaw-tools/src/browser.rs:448 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an http(s) URL; file:// URLs are not allowed in browser automation."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}