iflytek/astron-agent · warning · BusinessException

TOOLBOX_URL_SHORT_NOT_SUPPORTED

TOOLBOX_URL_SHORT_NOT_SUPPORTED

Error message

TOOLBOX_URL_SHORT_NOT_SUPPORTED

What it means

UrlCheckTool.resolveShortLink throws TOOLBOX_URL_SHORT_NOT_SUPPORTED when the URL's host matches a known URL-shortener domain (bit.ly, tinyurl.com, t.co, is.gd, t.ly, rebrandly.com, monojson.com, t.cn, url.cn, dwz.cn). Short links are blocked because they hide the real destination and enable redirect-based SSRF/phishing bypass.

Solutions

1. Expand the short link to its final destination URL (follow the redirect manually or with a curl -I) and submit the full URL instead.
2. Ask the link author for the original long URL.
3. If the domain is a legitimate non-shortener being falsely matched, note the domain list is a fixed constant (SHORT_LINK_DOMAINS) and requires a code change to extend.
4. Do not try to obfuscate the shortener domain (e.g. with userInfo or alternative encodings); the other checks (symbolCheck etc.) will reject those too.

Example fix

// before
urlCheckTool.checkUrl("https://bit.ly/3xYzAbC"); // TOOLBOX_URL_SHORT_NOT_SUPPORTED
// after: resolve the redirect first, then submit the destination
// curl -sI https://bit.ly/3xYzAbC | grep -i location -> https://example.com/real/page
urlCheckTool.checkUrl("https://example.com/real/page");

static final java.util.Set<String> SHORT_LINKS = java.util.Set.of("bit.ly","tinyurl.com","t.co","rebrandly.com","is.gd","t.ly","monojson.com","t.cn","url.cn","dwz.cn");
static boolean isShortLink(String url) {
    java.util.regex.Matcher m = java.util.regex.Pattern.compile("https?://([^/]+)").matcher(url);
    return m.find() && SHORT_LINKS.contains(m.group(1).toLowerCase(java.util.Locale.ROOT));
}
// call only if !isShortLink(url)

null

try {
    urlCheckTool.checkUrl(url);
} catch (BusinessException e) {
    if ("TOOLBOX_URL_SHORT_NOT_SUPPORTED".equals(e.getCode())) {
        // prompt user to provide the expanded destination URL
    } else { throw e; }
}

When it happens

Trigger: Calling checkUrl/resolveShortLink with a URL whose authority (the https?://([^/]+) capture, compared after IDN.toASCII and lowercasing) equals one of the SHORT_LINK_DOMAINS entries, e.g. "https://bit.ly/3xYz" or "http://t.cn/abc".

Common situations: Users pasting shortened links shared on social media or in chat, marketing content with shortened tracking URLs, or automation that shortens long URLs before submitting them to the toolbox.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

• Only HTTP and HTTPS remote resources are allowed
• Remote resource URL must not include user information
• Tool path must not change the endpoint origin
• Skill resource URL is not allowed
• MODEL_URL_CHECK_FAILED

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/3e1e720732b7587f. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java:276

    }

    /**
     * Blocks common short links (short links easily used for redirect bypass and phishing).
     *
     * @param shortUrl the URL to check for short link domains
     * @throws IOException if URL processing fails
     * @throws BusinessException if the URL is a known short link
     */
    public void resolveShortLink(String shortUrl) throws IOException {
        if (StringUtils.isBlank(shortUrl))
            return;

        Matcher matcher = DOMAIN_PATTERN.matcher(shortUrl);
        if (matcher.find()) {
            String domain = matcher.group(1);
            String asciiDomain = IDN.toASCII(domain).toLowerCase(Locale.ROOT);
            if (SHORT_LINK_DOMAINS.contains(asciiDomain)) {
                throw new BusinessException(ResponseEnum.TOOLBOX_URL_SHORT_NOT_SUPPORTED);
            }
        }
    }

    /**
     * Only allows HTTP/HTTPS protocols. Silently returns on parsing exception, let upper layer handle
     * uniformly.
     *
     * @param url the URL to validate protocol
     * @throws BusinessException if protocol is not HTTP or HTTPS
     */
    public void checkHttpOrHttps(String url) {
        try {
            URL parsed = new URL(url);
            String protocol = parsed.getProtocol();
            if (!"http".equalsIgnoreCase(protocol) && !"https".equalsIgnoreCase(protocol)) {
                throw new BusinessException(ResponseEnum.TOOLBOX_URL_HTTP_HTTPS_ONLY);
            }

View on GitHub (pinned to 5e758547a8)