What causes "TOOLBOX_URL_HTTP_HTTPS_ONLY" in iflytek/astron-agent?

Use an http:// or https:// URL including the explicit scheme prefix.

iflytek/astron-agent · error · BusinessException

TOOLBOX_URL_HTTP_HTTPS_ONLY

TOOLBOX_URL_HTTP_HTTPS_ONLY

Error message

TOOLBOX_URL_HTTP_HTTPS_ONLY

What it means

UrlCheckTool.checkHttpOrHttps (UrlCheckTool.java:293) enforces that a URL's protocol is exactly http or https (case-insensitive). The toolbox URL validation throws TOOLBOX_URL_HTTP_HTTPS_ONLY when java.net.URL parses the string but its protocol is anything else (ftp:, file:, ws:, javascript:, etc.). This is part of the SSRF/safety policy applied before the platform calls user-supplied endpoints. Malformed strings that cannot be parsed are silently ignored here and handled later by checkUrl's catch-all.

Solutions

Use an http:// or https:// URL including the explicit scheme prefix.
If the scheme is user-supplied, normalize it and reject non-http(s) schemes in your own UI before calling the API.
If you intended to allow other schemes, update the whitelist policy in the service layer rather than bypassing checkUrl.

Example fix

// before
checkHttpOrHttps("ftp://example.com/file"); // throws TOOLBOX_URL_HTTP_HTTPS_ONLY
// after
checkHttpOrHttps("https://example.com/file"); // passes

Defensive patterns

Strategy: validation

Validate before calling

boolean isHttpOrHttps(String url) {
    try {
        String p = new java.net.URL(url).getProtocol();
        return "http".equalsIgnoreCase(p) || "https".equalsIgnoreCase(p);
    } catch (Exception e) {
        return false;
    }
}

Try / catch

try {
    urlCheckTool.checkUrl(url);
} catch (BusinessException e) {
    if ("TOOLBOX_URL_HTTP_HTTPS_ONLY".equals(e.getCode())) {
        // show user: only http/https URLs are allowed
    }
}

Prevention

Always include an explicit http:// or https:// scheme when constructing URLs.
Reject or normalize non-http(s) schemes in your own input validation before calling the toolbox.
Never accept protocol-relative (//host) or scheme-less strings as endpoint URLs.

When it happens

Trigger: Calling checkHttpOrHttps(url) or checkUrl(url) with a URL whose parsed protocol is not http/https, e.g. "ftp://example.com/file", "file:///etc/passwd", "ws://host", or a protocol-relative or exotic-scheme string.

Common situations: Developers testing webhook/plugin URLs with file:// or custom scheme URIs; copying URLs from docs that use other schemes; users of the toolbox pasting non-HTTP endpoints into tool configuration; tests using protocol-relative URLs like "//example.com".

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/19e83db00f694c90. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java:293

            if (SHORT_LINK_DOMAINS.contains(asciiDomain)) {
                throw new BusinessException(ResponseEnum.TOOLBOX_URL_SHORT_NOT_SUPPORTED);
            }
        }
    }

    /**
     * Only allows HTTP/HTTPS protocols. Silently returns on parsing exception, let upper layer handle
     * uniformly.
     *
     * @param url the URL to validate protocol
     * @throws BusinessException if protocol is not HTTP or HTTPS
     */
    public void checkHttpOrHttps(String url) {
        try {
            URL parsed = new URL(url);
            String protocol = parsed.getProtocol();
            if (!"http".equalsIgnoreCase(protocol) && !"https".equalsIgnoreCase(protocol)) {
                throw new BusinessException(ResponseEnum.TOOLBOX_URL_HTTP_HTTPS_ONLY);
            }
        } catch (BusinessException e) {
            throw e;
        } catch (Exception ignore) {
            // Let upper layer handle uniformly
        }
    }

    /**
     * Prohibits user information (user:pass@host) to avoid SSRF/phishing disguise. Original
     * implementation was simple contains("@"), here more precise: check URI's userInfo.
     *
     * @param url the URL to check for user information
     * @throws BusinessException if URL contains user information
     */
    public void symbolCheck(String url) {
        try {
            URI uri = new URI(url);

View on GitHub (pinned to 5e758547a8)