diegosouzapw/OmniRoute · error · OutboundUrlGuardError

OUTBOUND_URL_INVALID

OUTBOUND_URL_INVALID

Error message

Invalid outbound URL: ${String(input)}

What it means

Error "Invalid outbound URL: ${String(input)}" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/shared/network/outboundUrlGuard.ts:89

 * SSRF→IAM-credential pivot and have no legitimate webhook/automation use case. They are
 * blocked UNCONDITIONALLY — even when private targets are explicitly opted in. (#3269)
 */
export function isCloudMetadataHost(hostname: string): boolean {
  const host = normalizeHost(hostname);
  if (!host) return false;
  if (isCloudMetadataIpv4(host)) return true;
  // An IPv4-mapped IPv6 literal routes to the embedded IPv4 address, so the same
  // verdict has to apply to it — otherwise this block is spelling-sensitive.
  const mapped = mappedIpv4Host(host);
  return mapped !== null && isCloudMetadataIpv4(mapped);
}

export function parseOutboundUrl(input: string | URL) {
  let url: URL;
  try {
    url = input instanceof URL ? input : new URL(String(input));
  } catch {
    throw new OutboundUrlGuardError(`Invalid outbound URL: ${String(input)}`, {
      code: "OUTBOUND_URL_INVALID",
      url: String(input),
    });
  }

  if (url.protocol !== "http:" && url.protocol !== "https:") {
    throw new OutboundUrlGuardError(`Invalid outbound URL protocol for ${url.toString()}`, {
      code: "OUTBOUND_URL_INVALID",
      url: url.toString(),
      hostname: url.hostname || null,
    });
  }

  if (url.username || url.password) {
    throw new OutboundUrlGuardError("Blocked outbound URL with embedded credentials", {
      code: "OUTBOUND_URL_GUARD_BLOCKED",
      url: url.toString(),
      hostname: url.hostname || null,

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/shared/network/outboundUrlGuard.ts:89 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/0a1b14245b10afad. Report an issue: GitHub.