{"record":{"id":"ca1da2a25b6f8bab","repo":"grafana/k6","slug":"origin-s-not-allowed-to-load-local-file-s","errorCode":null,"errorMessage":"origin (%s) not allowed to load local file: %s","messagePattern":"origin \\((.+?)\\) not allowed to load local file: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/loader/loader.go","lineNumber":68,"sourceCode":"\t\treturn nil, errors.New(\"local or remote path required\")\n\t}\n\n\tif moduleSpecifier[0] == '.' || moduleSpecifier[0] == '/' || filepath.IsAbs(moduleSpecifier) {\n\t\treturn resolveFilePath(pwd, moduleSpecifier)\n\t}\n\n\tif strings.Contains(moduleSpecifier, \"://\") {\n\t\tu, err := url.Parse(moduleSpecifier)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif u.Scheme != \"file\" && u.Scheme != \"https\" {\n\t\t\treturn nil,\n\t\t\t\tfmt.Errorf(\"only supported schemes for imports are file and https, %s has `%s`\",\n\t\t\t\t\tmoduleSpecifier, u.Scheme)\n\t\t}\n\t\tif u.Scheme == \"file\" && pwd.Scheme == \"https\" {\n\t\t\treturn nil, fmt.Errorf(\"origin (%s) not allowed to load local file: %s\", pwd, moduleSpecifier)\n\t\t}\n\t\treturn u, err\n\t}\n\n\tif strings.HasPrefix(moduleSpecifier, \"cdnjs.com\") {\n\t\treturn nil, fmt.Errorf(\"cdnjs.com 'special' urls are no longer supported - please use real ones. \" +\n\t\t\t\"You can get yours by going to cdnjs and copy-pasting the full url to the actual JavaScript file\")\n\t}\n\tif strings.HasPrefix(moduleSpecifier, \"github.com\") {\n\t\treturn nil, fmt.Errorf(\"github.com 'special' urls are no longer supported - please use real ones. \" +\n\t\t\t\"You can get yours by going to github and copy-pasting the full url to the actual raw JavaScript file\")\n\t}\n\treturn nil, unresolvableURLError(moduleSpecifier)\n}\n\nfunc resolveFilePath(pwd *url.URL, moduleSpecifier string) (*url.URL, error) {\n\tif pwd.Opaque != \"\" { // this is a loader reference\n\t\tbase, dir, _ := strings.Cut(pwd.Opaque, \"/\")","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/grafana/k6/blob/01ffac6f245854c1b8adc6a69857c76a15f90022/internal/loader/loader.go#L50-L86","documentation":"A security guard in Resolve. It fires when a script that was itself loaded from an https:// origin tries to import a file:// (local disk) module. This prevents remote code from reading arbitrary local files. The at-fault input is the file:// import made from an https origin.","triggerScenarios":"Thrown at internal/loader/loader.go:68 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Serve the required module over https and import it by its remote URL","Load the top-level script locally instead of from https so relative local imports are allowed","Copy the module next to the local script and import it with a relative path"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ffac6f245854c1b8adc6a69857c76a15f90022","analyzedAt":"2026-08-18T03:05:52.393Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}