{"record":{"id":"f4bba1f6e56fdc8e","repo":"musistudio/claude-code-router","slug":"only-http-https-and-ccr-plugin-urls-can-be-opene","errorCode":null,"errorMessage":"Only http, https, and CCR plugin URLs can be opened.","messagePattern":"Only http, https, and CCR plugin URLs can be opened\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/web/management-server.ts","lineNumber":1471,"sourceCode":"\nfunction normalizeExternalTarget(target: unknown): string | undefined {\n  const trimmed = typeof target === \"string\" ? target.trim() : \"\";\n  if (!trimmed || trimmed === \"about:blank\") {\n    return undefined;\n  }\n  let url: URL;\n  try {\n    url = new URL(trimmed);\n  } catch {\n    throw new Error(\"External URL must be a valid absolute URL.\");\n  }\n  if (url.protocol === \"http:\" || url.protocol === \"https:\") {\n    return url.toString();\n  }\n  if (url.protocol === \"ccr:\" && url.hostname.toLowerCase() === \"plugin\") {\n    return url.toString();\n  }\n  throw new Error(\"Only http, https, and CCR plugin URLs can be opened.\");\n}\n\nfunction execDetached(command: string, args: string[]): Promise<void> {\n  return new Promise((resolve, reject) => {\n    const child = spawn(command, args, {\n      detached: true,\n      stdio: \"ignore\",\n      windowsHide: true\n    });\n    child.once(\"error\", reject);\n    child.once(\"spawn\", () => {\n      child.unref();\n      resolve();\n    });\n  });\n}\n\nfunction contentTypeForFile(file: string): string {","sourceCodeStart":1453,"sourceCodeEnd":1489,"githubUrl":"https://github.com/musistudio/claude-code-router/blob/99f24806c6a2c660b16e53e95211c517448a6c90/packages/core/src/web/management-server.ts#L1453-L1489","documentation":"Thrown by the management server's URL-opening endpoint when the submitted URL's protocol is not http:, https:, or ccr: with a hostname of 'plugin'. It is a security guard preventing the app from opening arbitrary schemes (e.g. file:, javascript:, or custom OS handlers) that could escape the sandbox or launch arbitrary programs. Only whitelisted web URLs and the internal CCR plugin deep-link format are accepted.","triggerScenarios":"Calling the management server's open-URL API with a URL whose protocol is anything other than http:, https:, or ccr://plugin/... — e.g. 'file:///etc/passwd', 'ftp://host', 'ccr://settings', or a malformed string that URL-parses to an unexpected scheme.","commonSituations":"A client passes a user-supplied or clipboard-copied URL without sanitizing; a deep link built with the wrong ccr: hostname; attempts to open local file resources through a web-oriented endpoint.","solutions":["Change the URL to use http:// or https:// (e.g. https://example.com).","If you intend to open a CCR plugin, use the exact form ccr://plugin/<plugin-id> — the hostname must be 'plugin'.","Sanitize/validate URLs on the client side before sending them to the management server.","Do not attempt to open file:, ftp:, or custom OS schemes through this endpoint; use the appropriate file API instead."],"exampleFix":"// before\nawait client.openUrl(\"file:///home/user/report.pdf\");\n\n// after\nawait client.openUrl(\"https://example.com/report.pdf\");","handlingStrategy":"validation","validationCode":"function isOpenableUrl(value: string): boolean {\n  try {\n    const u = new URL(value);\n    return u.protocol === \"http:\" || u.protocol === \"https:\" ||\n      (u.protocol === \"ccr:\" && u.hostname.toLowerCase() === \"plugin\");\n  } catch {\n    return false;\n  }\n}\nif (!isOpenableUrl(url)) throw new Error(`Refusing to send non-openable URL: ${url}`);\nawait client.openUrl(url);","typeGuard":"function isOpenableUrl(value: string): value is `${\"http\" | \"https\"}://${string}` { /* see validationCode */ }","tryCatchPattern":"try { await client.openUrl(url); } catch (e) { if (e instanceof Error && e.message.includes(\"Only http, https, and CCR plugin URLs\")) { /* fix scheme, notify user */ } throw e; }","preventionTips":["Normalize user-supplied URLs through new URL() before sending","Whitelist protocols client-side","Never construct ccr: links with a hostname other than 'plugin'"],"tags":["url-validation","security","protocol-whitelist","management-server"],"backgroundTag":"url-protocol-not-allowed","analyzedSha":"99f24806c6a2c660b16e53e95211c517448a6c90","analyzedAt":"2026-08-27T04:11:01.184Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}