{"record":{"id":"a13ae85042faeede","repo":"toeverything/AFFiNE","slug":"caldav-host-blocked","errorCode":"caldav_host_blocked","errorMessage":"CalDAV host is not allowed.","messagePattern":"CalDAV host is not allowed\\.","errorType":"exception","errorClass":"GraphqlBadRequest","httpStatus":400,"severity":"error","filePath":"packages/backend/server/src/plugins/calendar/providers/caldav.ts","lineNumber":584,"sourceCode":"      });\n    }\n\n    if (\n      url.protocol !== 'https:' &&\n      !(url.protocol === 'http:' && this.allowInsecureHttp)\n    ) {\n      throw new GraphqlBadRequest({\n        code: 'caldav_insecure_url',\n        message: 'CalDAV URL must use https.',\n      });\n    }\n\n    const hostname = url.hostname.toLowerCase();\n    if (\n      this.allowedHosts.length &&\n      !isAllowedHost(hostname, this.allowedHosts)\n    ) {\n      throw new GraphqlBadRequest({\n        code: 'caldav_host_blocked',\n        message: 'CalDAV host is not allowed.',\n      });\n    }\n  }\n\n  private toGraphqlSsrfError(error: unknown) {\n    if (!(error instanceof SsrfBlockedError)) {\n      return null;\n    }\n\n    const reason = String(error.data?.reason ?? '');\n\n    if (reason === 'blocked_ip') {\n      return new GraphqlBadRequest({\n        code: 'caldav_private_network',\n        message: 'CalDAV host is in a private network.',\n      });","sourceCodeStart":566,"sourceCodeEnd":602,"githubUrl":"https://github.com/toeverything/AFFiNE/blob/b4c8548c09da21b2898443559a5b846f0ccf5dd8/packages/backend/server/src/plugins/calendar/providers/caldav.ts#L566-L602","documentation":"The CalDAV provider validates the user-supplied server URL against the configured allow-list of hosts and throws caldav_host_blocked GraphqlBadRequest when the hostname is not permitted, an SSRF/safety guard.","triggerScenarios":"Thrown at packages/backend/server/src/plugins/calendar/providers/caldav.ts:584 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Only connect to CalDAV hosts on the allowed-host list; remove the blocked host or add it to the server allowlist configuration.","If you are the server administrator, update the CalDAV allowed hosts setting to include this domain, then retry.","Use https and a public, non-private-network host; loopback and internal IPs are typically disallowed."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b4c8548c09da21b2898443559a5b846f0ccf5dd8","analyzedAt":"2026-08-18T21:16:52.546Z","contentChangedAt":"2026-08-18T21:16:52.546Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}