{"record":{"id":"a64bfb7711217f31","repo":"zeroclaw-labs/zeroclaw","slug":"only-http-and-https-urls-are-allowed","errorCode":null,"errorMessage":"Only http:// and https:// URLs are allowed","messagePattern":"Only http:// and https:// URLs are allowed","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/browser.rs","lineNumber":452,"sourceCode":"        }\n    }\n\n    /// Validate URL against allowlist\n    fn validate_url(&self, url: &str) -> anyhow::Result<()> {\n        let url = url.trim();\n\n        if url.is_empty() {\n            anyhow::bail!(\"URL cannot be empty\");\n        }\n\n        // Block file:// URLs — browser file access bypasses all SSRF and\n        // domain-allowlist controls and can exfiltrate arbitrary local files.\n        if url.starts_with(\"file://\") {\n            anyhow::bail!(\"file:// URLs are not allowed in browser automation\");\n        }\n\n        if !url.starts_with(\"https://\") && !url.starts_with(\"http://\") {\n            anyhow::bail!(\"Only http:// and https:// URLs are allowed\");\n        }\n\n        let parsed = reqwest::Url::parse(url)\n            .map_err(|e| anyhow::Error::msg(format!(\"Invalid URL format: {e}\")))?;\n\n        if !parsed.username().is_empty() || parsed.password().is_some() {\n            anyhow::bail!(\"URL userinfo is not allowed\");\n        }\n\n        if self.allowed_domains.is_empty() && self.allowed_private_hosts.is_empty() {\n            anyhow::bail!(\n                \"Browser tool enabled but no allowed_domains configured. \\\n                Add [browser].allowed_domains in config.toml\"\n            );\n        }\n\n        let host_str = parsed\n            .host_str()","sourceCodeStart":434,"sourceCodeEnd":470,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/browser.rs#L434-L470","documentation":"Error \"Only http:// and https:// URLs are allowed\" thrown in zeroclaw-labs/zeroclaw.","triggerScenarios":"Thrown at crates/zeroclaw-tools/src/browser.rs:452 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an http:// or https:// URL."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}