{"record":{"id":"c6e6a52fe1a5680d","repo":"google-gemini/gemini-cli","slug":"invalid-domain-in-alloweddomains-domain","errorCode":null,"errorMessage":"Invalid domain in allowedDomains: ${domain}","messagePattern":"Invalid domain in allowedDomains: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/agents/browser/browserManager.ts","lineNumber":680,"sourceCode":"        Storage.getGlobalGeminiDir(),\n        BROWSER_PROFILE_DIR,\n      );\n      mcpArgs.push('--userDataDir', defaultProfilePath);\n    }\n\n    // Respect the user's privacy.usageStatisticsEnabled setting\n    if (!this.config.getUsageStatisticsEnabled()) {\n      mcpArgs.push('--no-usage-statistics', '--no-performance-crux');\n    }\n\n    if (\n      browserConfig.customConfig.allowedDomains &&\n      browserConfig.customConfig.allowedDomains.length > 0\n    ) {\n      const exclusionRules = browserConfig.customConfig.allowedDomains\n        .map((domain) => {\n          if (!/^(\\*\\.)?([a-zA-Z0-9-]+\\.)*[a-zA-Z0-9-]+$/.test(domain)) {\n            throw new Error(`Invalid domain in allowedDomains: ${domain}`);\n          }\n          return `EXCLUDE ${domain}`;\n        })\n        .join(', ');\n      mcpArgs.push(\n        `--chromeArg=\"--host-rules=MAP * ~NOTFOUND, ${exclusionRules}\"`,\n      );\n    }\n\n    debugLogger.log(\n      `Launching bundled chrome-devtools-mcp (${sessionMode} mode) with args: ${mcpArgs.join(' ')}`,\n    );\n\n    // Create stdio transport to the bundled chrome-devtools-mcp.\n    // stderr is piped (not inherited) to prevent MCP server banners and\n    // warnings from corrupting the UI in alternate buffer mode.\n    let bundleMcpPath = path.resolve(\n      __dirname,","sourceCodeStart":662,"sourceCodeEnd":698,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/core/src/agents/browser/browserManager.ts#L662-L698","documentation":"Thrown while building chrome-devtools-mcp args in connectMcp(): a domain in customConfig.allowedDomains fails the regex /^(\\*\\.)?([a-zA-Z0-9-]+\\.)*[a-zA-Z0-9-]+$/. The regex permits an optional *. prefix and dotted labels of alphanumerics/hyphens only — no scheme, port, path, or trailing slash.","triggerScenarios":"connectMcp() iterating allowedDomains and calling .map; any entry containing '://', a port (:8080), a path (/path), a trailing slash, a wildcard not at the prefix, or characters outside [a-zA-Z0-9-.] causes the regex test to return false.","commonSituations":"Configuring allowedDomains with full URLs (https://example.com), host:port pairs, paths, trailing dots/slashes, or IP literals; uppercase scheme; a stray space; wildcard in the middle (foo.*.com).","solutions":["Use bare hostnames only: 'example.com', '*.example.com'.","Strip any scheme (https://), port (:443), path, query, and trailing slash before adding to allowedDomains.","For IP addresses or unusual hostnames, note the regex requires at least one alphanumeric label; avoid raw IPs (not matched) or extend config if needed.","Ensure wildcards are prefix-only: '*.example.com' is allowed; 'example.*' is not."],"exampleFix":"// before\nallowedDomains: ['https://example.com', 'example.com:443', 'api.example.com/']\n\n// after\nallowedDomains: ['example.com', '*.example.com']","handlingStrategy":"validation","validationCode":"const DOMAIN_RE = /^(\\*\\.)?([a-zA-Z0-9-]+\\.)*[a-zA-Z0-9-]+$/;\nfunction validateAllowedDomains(domains) {\n  for (const d of domains)\n    if (!DOMAIN_RE.test(d))\n      throw new Error(`Invalid domain in allowedDomains: ${d}`);\n}","typeGuard":"function isValidAllowedDomain(d) {\n  return /^(\\*\\.)?([a-zA-Z0-9-]+\\.)*[a-zA-Z0-9-]+$/.test(d);\n}","tryCatchPattern":null,"preventionTips":["Use bare hostnames only (no scheme, port, path, slash).","Allow wildcards only as a '*.' prefix.","Validate config at load time with the same regex the manager uses."],"tags":["browser","config","validation","domain-allowlist"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}