diegosouzapw/OmniRoute · error · Error

Subscription URL is not allowed (scheme or host blocked)

Error message

Subscription URL is not allowed (scheme or host blocked)

What it means

Error "Subscription URL is not allowed (scheme or host blocked)" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/lib/proxySubscription/subscriptionService.ts:299

// ───────────────────────────── Sync + apply ─────────────────────────────

/**
 * Refuse to fetch a subscription URL unless it is http/https to an allowed
 * host. IP literals are checked structurally; hostnames are resolved and the
 * resolved addresses are re-checked (fail closed on resolution errors).
 *
 * Local-first (#10158): loopback/private fetch targets are ALLOWED when
 * `areLocalProviderUrlsAllowed()` is on (default ON — same local-first policy
 * already used for provider validation, and consistent with
 * `coreEndpoint.ts` already permitting a loopback routing core). Cloud
 * metadata / link-local (169.254.0.0/16, incl. 169.254.169.254 IMDS) is
 * blocked UNCONDITIONALLY regardless of that flag.
 */
async function assertSafeFetchTarget(url: string): Promise<void> {
  const guardOpts: FetchGuardOptions = { allowLocal: areLocalProviderUrlsAllowed() };
  if (!isSubscriptionFetchUrlAllowed(url, guardOpts)) {
    throw new Error("Subscription URL is not allowed (scheme or host blocked)");
  }
  const host = new URL(url).hostname.toLowerCase();
  const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
  if (!isIpLiteral(bare)) {
    // Hostname: resolve ALL records and refuse if ANY address is internal
    // (fail closed). A hostname can resolve to multiple records; checking only
    // the first would let an internal IP slip through if a public record also
    // exists. `lookup(..., { all: true })` returns every A/AAAA record.
    try {
      const dns = await import("node:dns");
      const addrs = await dns.promises.lookup(bare, { all: true });
      if (isAnyResolvedAddressBlocked(addrs, guardOpts)) {
        throw new Error("Subscription host resolves to a blocked (internal) address");
      }
    } catch (e) {
      if (e instanceof Error && e.message.includes("blocked")) throw e;
      throw new Error(`Subscription host resolution failed: ${e instanceof Error ? e.message : e}`);
    }

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/lib/proxySubscription/subscriptionService.ts:299 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/286389376a4e08fb. Report an issue: GitHub.