paperclipai/paperclip · error · Error

Disallowed protocol "${parsed.protocol}" — only http: and ht

Error message

Disallowed protocol "${parsed.protocol}" — only http: and https: are permitted

What it means

The plugin fetch target parsed successfully but its scheme is not http: or https: (e.g. file:, ftp:). The SSRF allowlist in validateAndResolveFetchUrl rejects anything outside the two web protocols before DNS resolution happens.

Source

Thrown at server/src/services/plugin-host-services.ts:169

 */
interface ValidatedFetchTarget {
  parsedUrl: URL;
  resolvedAddress: string;
  hostHeader: string;
  tlsServername?: string;
  useTls: boolean;
}

async function validateAndResolveFetchUrl(urlString: string): Promise<ValidatedFetchTarget> {
  let parsed: URL;
  try {
    parsed = new URL(urlString);
  } catch {
    throw new Error(`Invalid URL: ${urlString}`);
  }

  if (!ALLOWED_PROTOCOLS.has(parsed.protocol)) {
    throw new Error(
      `Disallowed protocol "${parsed.protocol}" — only http: and https: are permitted`,
    );
  }

  // Resolve the hostname to an IP and check for private ranges.
  // We pin the resolved IP into the URL to eliminate the TOCTOU window
  // between DNS resolution here and the second resolution fetch() would do.
  const originalHostname = parsed.hostname.replace(/^\[|\]$/g, ""); // strip IPv6 brackets
  const hostHeader = parsed.host; // includes port if non-default

  // Race the DNS lookup against a timeout to prevent indefinite hangs
  // when DNS is misconfigured or unresponsive.
  const dnsPromise = dnsLookup(originalHostname, { all: true });
  const timeoutPromise = new Promise<never>((_, reject) => {
    setTimeout(
      () => reject(new Error(`DNS lookup timed out after ${DNS_LOOKUP_TIMEOUT_MS}ms for ${originalHostname}`)),
      DNS_LOOKUP_TIMEOUT_MS,
    );

View on GitHub (pinned to a7e689b3c3)

Solutions

1. Use an http: or https: URL; other protocols are not permitted.

When it happens

Trigger: Thrown at server/src/services/plugin-host-services.ts:169 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@a7e689b3c3 (2026-08-18). Data as JSON: /api/errors/88832c9dab315fb8. Report an issue: GitHub.