{"record":{"id":"ad11872d9ee6b11a","repo":"ory/hydra","slug":"http-s-loader-disabled","errorCode":null,"errorMessage":"http(s) loader disabled","messagePattern":"http\\(s\\) loader disabled","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/osx/file.go","lineNumber":177,"sourceCode":"\n\t\t//#nosec G304 -- false positive\n\t\tbytes, err = os.ReadFile(source)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"unable to read the file\")\n\t\t}\n\tcase \"file\":\n\t\tif o.disableFileLoader {\n\t\t\treturn nil, errors.New(\"file loader disabled\")\n\t\t}\n\n\t\t//#nosec G304 -- false positive\n\t\tbytes, err = os.ReadFile(parsed.Host + parsed.Path)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"unable to read the file\")\n\t\t}\n\tcase \"http\", \"https\":\n\t\tif o.disableHTTPLoader {\n\t\t\treturn nil, errors.New(\"http(s) loader disabled\")\n\t\t}\n\t\tresp, err := o.hc.Get(parsed.String())\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"unable to load remote file\")\n\t\t}\n\t\tdefer resp.Body.Close()\n\n\t\tbytes, err = io.ReadAll(resp.Body)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"unable to read the HTTP response body\")\n\t\t}\n\tcase \"base64\":\n\t\tif o.disableBase64Loader {\n\t\t\treturn nil, errors.New(\"base64 loader disabled\")\n\t\t}\n\n\t\tif o.disableResilientBase64Loader {\n\t\t\tbytes, err = o.base64enc.DecodeString(strings.TrimPrefix(source, \"base64://\"))","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/osx/file.go#L159-L195","documentation":"When the source URL uses http or https, readFile checks the o.disableHTTPLoader option before performing the request via o.hc.Get. If remote HTTP loading is disabled, it returns errors.New(\"http(s) loader disabled\"). This guard lets callers restrict readers to specific source types (e.g. local files only) and rejects any remote fetch attempt.","triggerScenarios":"Calling RestrictedReadFile or ReadFileFromAllSources with an http:// or https:// URL while the Options were constructed with the disable-HTTP-loader option set (DisableHTTPLoader(true) or equivalent).","commonSituations":"Air-gapped or SSRF-hardened deployments that disable remote fetching, but a template/config still references a remote URL; migrating configs from hosted URLs to local files and forgetting the reverse case where a remote ref is required.","solutions":["Construct the Options without disabling the HTTP loader if remote URLs are acceptable in your environment","Change the source to a file path or file:// URL if the file loader is enabled and the content exists locally","Serve the content from a scheme that is enabled, or embed/vendor the file into the deployment","If the restriction is intentional (SSRF hardening), fetch the document out-of-band and pass its bytes instead of a URL"],"exampleFix":"// before\n// opts has DisableHTTPLoader(true)\ndata, err := osx.RestrictedReadFile(\"https://example.com/schema.json\") // error\n// after\nopts.DisableHTTPLoader(false) // or download first:\ndata, err := osx.RestrictedReadFile(\"./schema.json\")","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"func isRemoteURL(source string) bool {\n\tu, err := url.Parse(source)\n\treturn err == nil && (u.Scheme == \"http\" || u.Scheme == \"https\")\n}","tryCatchPattern":"data, err := osx.RestrictedReadFile(source)\nif err != nil {\n\tif err.Error() == \"http(s) loader disabled\" {\n\t\t// use a local mirror or re-enable the HTTP loader\n\t}\n\treturn err\n}","preventionTips":["In air-gapped/SSRF-hardened deployments, ensure every configured source is local (path or file://) when the HTTP loader is off","Vendor remote dependencies (schemas, templates) into the deployment instead of URL references","Keep loader-allow/deny policy in one Options struct and validate all configured sources against it at startup","Catch \"http(s) loader disabled\" and fall back to a local mirror of the resource"],"tags":["go","osx","http","security","configuration"],"backgroundTag":"file-loader-disabled","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}