{"record":{"id":"ee727292d964dd19","repo":"tinyhumansai/openhuman","slug":"url-userinfo-is-not-allowed","errorCode":null,"errorMessage":"URL userinfo is not allowed","messagePattern":"URL userinfo is not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/openhuman/tools/impl/browser/browser_open.rs","lineNumber":215,"sourceCode":"    Some(d)\n}\n\nfn extract_host(url: &str) -> anyhow::Result<String> {\n    let rest = url\n        .strip_prefix(\"https://\")\n        .ok_or_else(|| anyhow::anyhow!(\"Only https:// URLs are allowed\"))?;\n\n    let authority = rest\n        .split(['/', '?', '#'])\n        .next()\n        .ok_or_else(|| anyhow::anyhow!(\"Invalid URL\"))?;\n\n    if authority.is_empty() {\n        anyhow::bail!(\"URL must include a host\");\n    }\n\n    if authority.contains('@') {\n        anyhow::bail!(\"URL userinfo is not allowed\");\n    }\n\n    if authority.starts_with('[') {\n        anyhow::bail!(\"IPv6 hosts are not supported in browser_open\");\n    }\n\n    let host = authority\n        .split(':')\n        .next()\n        .unwrap_or_default()\n        .trim()\n        .trim_end_matches('.')\n        .to_lowercase();\n\n    if host.is_empty() {\n        anyhow::bail!(\"URL must include a valid host\");\n    }\n","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/749120085864ce16e0f273c7b86fac7740b39c5b/src/openhuman/tools/impl/browser/browser_open.rs#L197-L233","documentation":"extract_host rejects any URL whose authority contains '@' (userinfo). Userinfo in a URL can be used to smuggle a different real host past allowlist inspection (e.g. https://allowed.com@evil.com/), so it is refused before host extraction.","triggerScenarios":"Thrown at src/openhuman/tools/impl/browser/browser_open.rs:215 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove credentials/userinfo from the URL.","Authenticate via the browser/session instead of embedding credentials in the URL."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"749120085864ce16e0f273c7b86fac7740b39c5b","analyzedAt":"2026-08-17T21:21:45.363Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}