What causes "only http/https URLs are supported" in larksuite/cli?

Use an https:// (or http://) URL for the source.

only http/https URLs are supported

Error message

only http/https URLs are supported

What it means

After parsing, ValidateDownloadSourceURL requires the scheme to be http or https; any other scheme (file:, ftp:, data:, etc.) is rejected with this message. This confines downloads to web URLs and blocks local-file or non-HTTP access vectors. DNS/SSRF checks run only after this gate passes.

Source

Thrown at internal/validate/url.go:87

	}
	ip16 := ip.To16()
	if ip16 == nil {
		return true
	}
	if ip16[0]&0xfe == 0xfc { // fc00::/7 unique local address
		return true
	}
	return false
}

// ValidateDownloadSourceURL validates a download URL and blocks local/internal targets.
func ValidateDownloadSourceURL(ctx context.Context, rawURL string) error {
	u, err := url.Parse(rawURL)
	if err != nil || u == nil {
		return fmt.Errorf("invalid URL")
	}
	if u.Scheme != "http" && u.Scheme != "https" {
		return fmt.Errorf("only http/https URLs are supported")
	}
	_, err = resolveDownloadHost(ctx, u.Hostname(), net.DefaultResolver.LookupIP)
	return err
}

type downloadLookupIPFunc func(context.Context, string, string) ([]net.IP, error)

func resolveDownloadHost(ctx context.Context, rawHost string, lookupIP downloadLookupIPFunc) ([]net.IP, error) {
	host := strings.TrimSpace(strings.ToLower(rawHost))
	if host == "" {
		return nil, fmt.Errorf("URL host is required")
	}
	if host == "localhost" || strings.HasSuffix(host, ".localhost") {
		return nil, fmt.Errorf("local/internal host is not allowed")
	}
	if ip := net.ParseIP(host); ip != nil {
		if isRestrictedDownloadIP(ip) {
			return nil, fmt.Errorf("local/internal host is not allowed")

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Use an https:// (or http://) URL for the source.
For local files, read them directly instead of routing through the download command.
Download via FTP/other protocols with a dedicated tool first, then process the local file.
If the source is a doc image, ensure the exported link is an HTTP(S) URL.

Example fix

// before
lark-cli download url "file:///tmp/report.pdf"
// after
cp /tmp/report.pdf /destination/   # local files don't go through download url
# or: lark-cli download url "https://example.com/report.pdf"

Defensive patterns

Strategy: validation

Validate before calling

u, _ := url.Parse(rawURL)
if u == nil || (u.Scheme != "http" && u.Scheme != "https") {
    return fmt.Errorf("use an http/https URL")
}

Try / catch

if err := validate.ValidateDownloadSourceURL(ctx, raw); err != nil {
    if strings.Contains(err.Error(), "only http/https") {
        return fmt.Errorf("download source must be http/https; handle this source separately: %w", err)
    }
    return err
}

Prevention

Only pass web URLs to download commands; use file tools for local files.
Convert ftp:// or other scheme sources with a dedicated tool first.
Whitelist http/https at your own input boundary before invoking the CLI.
Beware crafted links using data:/file: schemes in untrusted content.

When it happens

Trigger: ValidateDownloadSourceURL receives a parsed URL whose u.Scheme is not "http" or "https" — e.g. file:///etc/passwd, ftp://host/file, or a data: URL.

Common situations: Attempting to download local files via file:// URLs, pointing the download command at FTP mirrors, or doc image sources that reference non-HTTP protocols.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/816eb04c24933ade. Report an issue: GitHub.