{"record":{"id":"a6f4a22552922ab3","repo":"Kong/insomnia","slug":"remote-extends-url-targets-a-disallowed-host","errorCode":null,"errorMessage":"Remote \"extends\" URL targets a disallowed host: ${url.href}","messagePattern":"Remote \"extends\" URL targets a disallowed host: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/insomnia/src/main/bundle-spectral-ruleset.ts","lineNumber":88,"sourceCode":"function parseRemoteExtendsUrl(entry: string, base?: URL): URL {\n  try {\n    return new URL(entry, base);\n  } catch {\n    throw new Error(`\"extends\" entry \"${entry}\" is not a valid spectral identifier, local path, or URL.`);\n  }\n}\n\n// Rejects URLs that could be used for SSRF attacks:\n// - Must be https (no http, ftp, file, etc.)\n// - Hostname must not be a known private/loopback address\n// - DNS resolution must not yield a private/loopback address\nasync function assertSafeRemoteUrl(url: URL): Promise<void> {\n  const hostname = url.hostname.toLowerCase();\n  if (url.protocol !== 'https:') {\n    throw new Error(`Remote \"extends\" URL ${url.href} must use https`);\n  }\n  if (!hostname || isPrivateOrLoopbackHost(hostname)) {\n    throw new Error(`Remote \"extends\" URL targets a disallowed host: ${url.href}`);\n  }\n  // The literal hostname can still resolve to an internal address (e.g. *.localtest.me → 127.0.0.1).\n  const records = await dns.lookup(hostname, { all: true });\n  for (const { address } of records) {\n    if (isPrivateOrLoopbackHost(address.toLowerCase())) {\n      throw new Error(`Failed to resolve host. \"${url.href}\" resolves to a private or loopback address.`);\n    }\n  }\n}\n\n// Fetches and parses a remote ruleset over the network. The URL is SSRF-checked before\n// any network call is made. Redirects are rejected because a redirect could forward us\n// to an internal host that bypassed the assertSafeRemoteUrl check.\nasync function readRemoteRuleset(url: URL): Promise<Ruleset> {\n  await assertSafeRemoteUrl(url);\n\n  let response: Response;\n  try {","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/Kong/insomnia/blob/d9bb2b0142600f21309832daea3317942d285984/packages/insomnia/src/main/bundle-spectral-ruleset.ts#L70-L106","documentation":"Error \"Remote \"extends\" URL targets a disallowed host: ${url.href}\" thrown in Kong/insomnia.","triggerScenarios":"Thrown at packages/insomnia/src/main/bundle-spectral-ruleset.ts:88 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d9bb2b0142600f21309832daea3317942d285984","analyzedAt":"2026-08-26T18:04:05.187Z","schemaVersion":2},"datasetVersion":"2026-08-26T21:11:00.512Z"}