{"record":{"id":"9e711deb511634a6","repo":"n8n-io/n8n","slug":"invalid-url-in-allow-list-entry-error-in","errorCode":null,"errorMessage":"Invalid URL in allow list: \"${entry}\" - ${error instanceof Error ? error.message : error}","messagePattern":"Invalid URL in allow list: \"(.+?)\" - (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/@n8n/nodes-langchain/nodes/Guardrails/actions/checks/urls.ts","lineNumber":218,"sourceCode":"\n\tfor (const allowedEntry of allowList) {\n\t\tconst entry = allowedEntry.toLowerCase().trim();\n\n\t\t// Handle full URLs with specific paths\n\t\tif (entry.includes('://')) {\n\t\t\ttry {\n\t\t\t\tconst allowedUrl = new URL(entry);\n\t\t\t\tconst allowedHost = allowedUrl.hostname?.toLowerCase();\n\t\t\t\tconst allowedPath = allowedUrl.pathname;\n\n\t\t\t\tif (urlHost === allowedHost) {\n\t\t\t\t\t// Check if the URL path starts with the allowed path\n\t\t\t\t\tif (!allowedPath || allowedPath === '/' || parsedUrl.pathname.startsWith(allowedPath)) {\n\t\t\t\t\t\treturn true;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Invalid URL in allow list: \"${entry}\" - ${error instanceof Error ? error.message : error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Handle IP addresses and CIDR blocks\n\t\ttry {\n\t\t\t// Basic IP pattern check\n\t\t\tif (/^\\d+\\.\\d+\\.\\d+\\.\\d+/.test(entry.split('/')[0])) {\n\t\t\t\tif (entry === urlHost) {\n\t\t\t\t\treturn true;\n\t\t\t\t}\n\t\t\t\t// Proper CIDR validation\n\t\t\t\tif (entry.includes('/') && urlHost.match(/^\\d+\\.\\d+\\.\\d+\\.\\d+$/)) {\n\t\t\t\t\tconst [network, prefixStr] = entry.split('/');\n\t\t\t\t\tconst prefix = parseInt(prefixStr);\n","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/nodes-langchain/nodes/Guardrails/actions/checks/urls.ts#L200-L236","documentation":"Thrown by the Guardrails URL allow-list check when constructing `new URL(entry)` for an allow-list entry raises an exception. Each allow-list entry must be a URL string parseable by the WHATWG URL parser; anything that fails parsing is treated as an invalid configuration value and aborts the check rather than being silently ignored.","triggerScenarios":"The allow-list is iterated and for each entry the code attempts `new URL(entry)` inside a try/catch. The catch re-throws a descriptive Error only when urlHost matches or the entry is meant to be evaluated as a URL. Triggers: an entry without a scheme (e.g. \"example.com\"), a malformed string (e.g. \"ht!tp://x\"), a stray protocol-relative \"//host\", or a non-URL value placed in a URL allow-list field.","commonSituations":"Users pasting bare hostnames instead of full URLs into the Guardrails URL allow list; copy-pasting entries with trailing spaces or smart quotes; mixing CIDR/IP entries (handled by a later branch) with URL entries and forgetting the URL branch still runs `new URL` on them when urlHost coincidentally matches.","solutions":["Give every URL allow-list entry a full form including scheme, e.g. \"https://example.com\" rather than \"example.com\".","Trim whitespace and remove smart quotes / invisible characters from pasted entries.","Move pure IP/CIDR entries to the field meant for them so they are not parsed as URLs, or confirm they only reach the IP/CIDR branch.","Validate the whole allow list with `new URL()` in a scratch script before saving the node parameters."],"exampleFix":"// before\nconst allowList = ['example.com', 'https://api.example.com'];\n// after\nconst allowList = ['https://example.com', 'https://api.example.com'];","handlingStrategy":"validation","validationCode":"function isValidUrlEntry(entry) {\n  try { new URL(entry); return true; } catch { return false; }\n}\nconst clean = allowList.filter((e) => typeof e === 'string' && e.trim() && isValidUrlEntry(e.trim()));","typeGuard":"function isParseableUrl(entry) { try { new URL(entry); return true; } catch { return false; } }","tryCatchPattern":"try {\n  new URL(entry);\n} catch (e) {\n  // skip or collect invalid entries instead of aborting the whole check\n}","preventionTips":["Normalize allow-list entries to full https:// URLs before saving.","Trim whitespace and reject empty entries at input time.","Run a one-off URL.parse sweep over saved allow lists after imports."],"tags":["guardrails","url","validation","config"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}