{"record":{"id":"d7d489ad553e8227","repo":"responsively-org/responsively-app","slug":"invalid-url","errorCode":null,"errorMessage":"Invalid URL","messagePattern":"Invalid URL","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"desktop-app/src/renderer/components/ToolBar/AddressBar/index.tsx","lineNumber":141,"sourceCode":"    e.preventDefault();\n    setIsDragOver(true);\n  };\n\n  const handleDragExit = (e: DragEvent) => {\n    e.preventDefault();\n    setIsDragOver(false);\n  };\n\n  const handleDrop = (e: DragEvent) => {\n    e.preventDefault();\n    setIsDragOver(false);\n    const draggedText = e.dataTransfer.getData('text/plain');\n    try {\n      const draggedUrl = new URL(draggedText);\n      if (draggedUrl.protocol === 'http:' || draggedUrl.protocol === 'https:') {\n        dispatchAddress(draggedUrl.href);\n      } else {\n        throw new Error('Invalid URL');\n      }\n    } catch (err) {\n      // eslint-disable-next-line no-console\n      console.error('Invalid URL', err);\n    }\n  };\n\n  const deleteCookies = async () => {\n    setDeleteCookiesLoading(true);\n    await webViewPubSub.publish(ADDRESS_BAR_EVENTS.DELETE_COOKIES);\n    setDeleteCookiesLoading(false);\n  };\n\n  const deleteStorage = async () => {\n    setDeleteStorageLoading(true);\n    await webViewPubSub.publish(ADDRESS_BAR_EVENTS.DELETE_STORAGE);\n    setDeleteStorageLoading(false);\n  };","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/responsively-org/responsively-app/blob/e5623c5a70c0c476b3f247c8d3980c7224e36410/desktop-app/src/renderer/components/ToolBar/AddressBar/index.tsx#L123-L159","documentation":"handleDrop accepts dragged text and tries to construct a URL from it. If the text parses but its protocol is neither http: nor https: (or it fails to parse at all, which throws from the URL constructor and lands in the same catch), the code throws 'Invalid URL' which is immediately caught and logged to console.error. It is a control-flow signal to reject non-web URLs dropped onto the address bar.","triggerScenarios":"Dragging text, a javascript: or file: link, or any non-URL string onto the address bar; new URL(draggedText) throws SyntaxError or the protocol check fails and the explicit throw fires.","commonSituations":"Users dragging bookmarks with custom schemes, dragging plain text from an editor, dragging file:// links from the OS file manager, or dragging mailto:/ftp: links from a browser.","solutions":["Validate the text with a regex or URL parse before constructing, and silently ignore non-URL drops","Show a user-visible toast/notification instead of only logging to console so the user knows the drop was rejected","Allow useful schemes (file:, about:) explicitly if product requirements permit","Prefix bare text like 'example.com' with https:// before parsing"],"exampleFix":"// before\nconst draggedText = e.dataTransfer.getData('text/plain');\nconst draggedUrl = new URL(draggedText);\n// after\nconst draggedText = e.dataTransfer.getData('text/plain').trim();\nif (!/^https?:\\/\\//i.test(draggedText)) return;\nconst draggedUrl = new URL(draggedText);","handlingStrategy":"validation","validationCode":"const text = e.dataTransfer.getData('text/plain').trim();\nlet isValidDropUrl = false;\ntry {\n  const u = new URL(text);\n  isValidDropUrl = u.protocol === 'http:' || u.protocol === 'https:';\n} catch { isValidDropUrl = false; }","typeGuard":"function isHttpUrl(s: string): boolean {\n  try {\n    const u = new URL(s);\n    return u.protocol === 'http:' || u.protocol === 'https:';\n  } catch {\n    return false;\n  }\n}","tryCatchPattern":"try {\n  const draggedUrl = new URL(draggedText);\n  if (draggedUrl.protocol === 'http:' || draggedUrl.protocol === 'https:') {\n    dispatchAddress(draggedUrl.href);\n  }\n} catch (err) {\n  console.warn('Ignoring non-URL drop:', draggedText, err);\n  // optionally notifyUser('Not a valid web link')\n}","preventionTips":["Validate with /^https?:\\/\\//i before constructing a URL","Never rely on exceptions for expected user input; return early instead of throw","Surface rejected drops with UI feedback, not just console.error","Consider auto-prepending https:// for bare domains"],"tags":["url-validation","drag-and-drop","user-input","renderer"],"backgroundTag":"invalid-url-input","analyzedSha":"e5623c5a70c0c476b3f247c8d3980c7224e36410","analyzedAt":"2026-08-31T10:58:12.271Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}