{"record":{"id":"e2b4247690d3406c","repo":"Kong/insomnia","slug":"remote-extends-url-url-href-must-use-https","errorCode":null,"errorMessage":"Remote \"extends\" URL ${url.href} must use https","messagePattern":"Remote \"extends\" URL (.+?) must use https","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/insomnia/src/main/bundle-spectral-ruleset.ts","lineNumber":85,"sourceCode":"\n// Resolves an \"extends\" entry into a URL. When `base` is provided, relative paths are\n// resolved against it — used when processing extends entries inside a remote ruleset.\nfunction parseRemoteExtendsUrl(entry: string, base?: URL): URL {\n  try {\n    return new URL(entry, base);\n  } catch {\n    throw new Error(`\"extends\" entry \"${entry}\" is not a valid spectral identifier, local path, or URL.`);\n  }\n}\n\n// Rejects URLs that could be used for SSRF attacks:\n// - Must be https (no http, ftp, file, etc.)\n// - Hostname must not be a known private/loopback address\n// - DNS resolution must not yield a private/loopback address\nasync function assertSafeRemoteUrl(url: URL): Promise<void> {\n  const hostname = url.hostname.toLowerCase();\n  if (url.protocol !== 'https:') {\n    throw new Error(`Remote \"extends\" URL ${url.href} must use https`);\n  }\n  if (!hostname || isPrivateOrLoopbackHost(hostname)) {\n    throw new Error(`Remote \"extends\" URL targets a disallowed host: ${url.href}`);\n  }\n  // The literal hostname can still resolve to an internal address (e.g. *.localtest.me → 127.0.0.1).\n  const records = await dns.lookup(hostname, { all: true });\n  for (const { address } of records) {\n    if (isPrivateOrLoopbackHost(address.toLowerCase())) {\n      throw new Error(`Failed to resolve host. \"${url.href}\" resolves to a private or loopback address.`);\n    }\n  }\n}\n\n// Fetches and parses a remote ruleset over the network. The URL is SSRF-checked before\n// any network call is made. Redirects are rejected because a redirect could forward us\n// to an internal host that bypassed the assertSafeRemoteUrl check.\nasync function readRemoteRuleset(url: URL): Promise<Ruleset> {\n  await assertSafeRemoteUrl(url);","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/Kong/insomnia/blob/d9bb2b0142600f21309832daea3317942d285984/packages/insomnia/src/main/bundle-spectral-ruleset.ts#L67-L103","documentation":"Error \"Remote \"extends\" URL ${url.href} must use https\" thrown in Kong/insomnia.","triggerScenarios":"Thrown at packages/insomnia/src/main/bundle-spectral-ruleset.ts:85 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d9bb2b0142600f21309832daea3317942d285984","analyzedAt":"2026-08-26T18:04:05.187Z","schemaVersion":2},"datasetVersion":"2026-08-26T21:11:00.512Z"}