{"record":{"id":"ba96d0c2132a0d67","repo":"FlowiseAI/Flowise","slug":"invalid-base-url-must-be-a-valid-url-ba96d0","errorCode":null,"errorMessage":"Invalid base URL: must be a valid URL","messagePattern":"Invalid base URL: must be a valid URL","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/nodes/sequentialagents/ExecuteFlow/ExecuteFlow.ts","lineNumber":180,"sourceCode":"            typeof nodeData.inputs?.overrideConfig === 'string' &&\n            nodeData.inputs.overrideConfig.startsWith('{') &&\n            nodeData.inputs.overrideConfig.endsWith('}')\n                ? JSON.parse(nodeData.inputs.overrideConfig)\n                : nodeData.inputs?.overrideConfig\n\n        if (!sequentialNodes || !sequentialNodes.length) throw new Error('Execute Flow must have a predecessor!')\n\n        const baseURL = (nodeData.inputs?.baseURL as string) || (options.baseURL as string)\n        const returnValueAs = nodeData.inputs?.returnValueAs as string\n\n        // Validate selectedFlowId is a valid UUID\n        if (!selectedFlowId || !isValidUUID(selectedFlowId)) {\n            throw new Error('Invalid flow ID: must be a valid UUID')\n        }\n\n        // Validate baseURL is a valid URL\n        if (!baseURL || !isValidURL(baseURL)) {\n            throw new Error('Invalid base URL: must be a valid URL')\n        }\n\n        const credentialData = await getCredentialData(nodeData.credential ?? '', options)\n        const chatflowApiKey = getCredentialParam('chatflowApiKey', credentialData, nodeData)\n\n        if (selectedFlowId === options.chatflowid) throw new Error('Cannot call the same agentflow!')\n\n        let headers = {}\n        if (chatflowApiKey) headers = { Authorization: `Bearer ${chatflowApiKey}` }\n\n        const chatflowId = options.chatflowid\n        const sessionId = options.sessionId\n        const chatId = options.chatId\n\n        const executeFunc = async (state: ISeqAgentsState) => {\n            const variables = await getVars(appDataSource, databaseEntities, nodeData, options)\n\n            let flowInput = ''","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/nodes/sequentialagents/ExecuteFlow/ExecuteFlow.ts#L162-L198","documentation":"The base URL must pass isValidURL, a security-hardened check: protocol must be http or https; hash fragments are rejected (they are an interpolation-exploit entry point); and the characters double-quote, single-quote, backtick, backslash, newline, carriage-return, and tab are rejected because the URL is later interpolated into JS. An empty, non-http, or fragment-bearing URL fails at init.","triggerScenarios":"baseURL is empty (and options.baseURL is also unset); a scheme-less host like 'localhost:3000'; a URL containing a '#fragment'; a URL containing a quote or backslash from copy-paste; a non-http protocol (ftp:, file:).","commonSituations":"Running behind a reverse proxy and typing 'localhost:3000' without a scheme; leaving baseURL empty expecting a default that is not configured in options.baseURL; appending an anchor to the URL; copy-paste introducing stray quotes.","solutions":["Provide a full URL with scheme, e.g. http://localhost:3000 or https://flowise.example.com.","Strip any '#fragment' from the URL.","Remove any quotes, backslashes, or template-literal characters.","If relying on the server default, ensure options.baseURL is configured on the Flowise instance."],"exampleFix":"// before (throws: no scheme, has fragment)\nlocalhost:3000/api/v1/prediction/#main\n\n// after\nhttp://localhost:3000/api/v1/prediction/main","handlingStrategy":"validation","validationCode":"import { isValidURL } from '../../../src/validator'\nconst baseURL = (nodeData.inputs?.baseURL as string) || (options.baseURL as string)\nif (!baseURL || !isValidURL(baseURL)) throw new Error('baseURL must be an http(s) URL with no fragment or escape chars')","typeGuard":"const isSafeHttpUrl = (u: string): boolean => {\n  try {\n    const p = new URL(u)\n    return (p.protocol === 'http:' || p.protocol === 'https:') && !p.hash && !/[\"'`\\\\\\n\\r\\t]/.test(u)\n  } catch { return false }\n}","tryCatchPattern":null,"preventionTips":["Always include the http:// or https:// scheme.","Never append a '#fragment'; strip it before passing the URL.","If relying on a server default, set options.baseURL in the Flowise config."],"tags":["execute-flow","url-validation","security","init"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}