iflytek/astron-agent · error · RemoteResourcePolicyError

Only HTTP and HTTPS remote resources are allowed

Error message

Only HTTP and HTTPS remote resources are allowed

What it means

_validate_parsed_resource_url only permits http and https schemes (_ALLOWED_SCHEMES). Any other scheme — ftp, file, data, gopher, jar, ws, etc. — is rejected with 'Only HTTP and HTTPS remote resources are allowed'. This blocks non-HTTP protocols that enable local-file reads or exotic SSRF vectors.

Solutions

1. Use an https:// (or http://) URL; re-host the file on an HTTP server if it currently lives on ftp or local disk.
2. If the caller may omit the scheme, normalize it first: prepend 'https://' when '://' is absent.
3. Check for typos in the scheme string.

Example fix

// before
await fetch_public_resource("ftp://files.example.com/report.pdf")
// after
await fetch_public_resource("https://files.example.com/report.pdf")

from urllib.parse import urlsplit
assert urlsplit(url).scheme.lower() in ("http", "https")

def is_http_url(u):
    try:
        return urlsplit(u).scheme.lower() in ("http", "https")
    except (TypeError, ValueError):
        return False

try:
    data = await fetch_public_resource(url)
except HTTPClientException as e:
    if "HTTP and HTTPS" in str(e):
        ...  # normalize or reject non-http(s) inputs

When it happens

Trigger: Passing 'file:///etc/passwd', 'ftp://...', 'data:text/html,...', 'gopher://...' or an empty/missing scheme ('example.com/file') to fetch_public_resource.

Common situations: Trying to download local files through the downloader; frontend sending scheme-less URLs assuming the server will add https://; internal tooling that traditionally uses ftp mirrors; mixed-case schemes are fine (checked lowercased), but typos like 'hthps' are not.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

• Remote resource URL must not include user information
• TOOLBOX_URL_ILLEGAL
• TOOLBOX_URL_SHORT_NOT_SUPPORTED
• Tool path must not change the endpoint origin
• Outbound URL origin is invalid

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/4586f878b8db52b9. Report an issue: GitHub.

Appendix: source

Thrown at core/plugin/aitools/common/clients/safe_download.py:209

    except (TypeError, ValueError) as exc:
        raise RemoteResourcePolicyError("Remote resource URL is malformed") from exc
    _validate_parsed_resource_url(parsed, port)
    return parsed


def _validate_url_characters(url: str) -> None:
    if not isinstance(url, str) or any(
        ord(character) < 0x20 or ord(character) == 0x7F for character in url
    ):
        raise RemoteResourcePolicyError("Remote resource URL is malformed")


def _validate_parsed_resource_url(
    parsed: SplitResult,
    port: Optional[int],
) -> None:
    if parsed.scheme.lower() not in _ALLOWED_SCHEMES:
        raise RemoteResourcePolicyError(
            "Only HTTP and HTTPS remote resources are allowed"
        )
    if not parsed.hostname:
        raise RemoteResourcePolicyError("Remote resource URL must include a hostname")
    if parsed.username is not None or parsed.password is not None:
        raise RemoteResourcePolicyError(
            "Remote resource URL must not include user information"
        )
    if "\\" in parsed.netloc:
        raise RemoteResourcePolicyError("Remote resource URL authority is invalid")
    if parsed.fragment:
        raise RemoteResourcePolicyError(
            "Remote resource URL must not include a fragment"
        )
    if port is not None and not 1 <= port <= 65535:
        raise RemoteResourcePolicyError("Remote resource URL port is invalid")

View on GitHub (pinned to 5e758547a8)