toeverything/AFFiNE · error

Invalid embed iframe url: ${url}

Error message

Invalid embed iframe url: ${url}

What it means

Warning logged in `validateEmbedIframeUrl` when `new URL(url)` throws on a malformed embed URL. Returns false, classifying the URL as invalid; the inputs at fault are embed src strings that are not syntactically valid URLs (and therefore cannot be safety-checked against allowed protocols/hostnames).

Source

Thrown at blocksuite/affine/blocks/embed/src/embed-iframe-block/utils.ts:59

  try {
    const parsedUrl = new URL(url);

    const { protocols, hostnames } = options;
    if (
      parsedUrl.username ||
      parsedUrl.password ||
      parsedUrl.port ||
      isLocalOrIpHostname(parsedUrl.hostname)
    ) {
      return false;
    }

    return (
      protocols.includes(parsedUrl.protocol) &&
      hostnames.includes(parsedUrl.hostname)
    );
  } catch (e) {
    console.warn(`Invalid embed iframe url: ${url}`, e);
    return false;
  }
}

/**
 * Safely extracts the src URL from an iframe HTML string
 * @param htmlString The iframe HTML string to parse
 * @param options Optional validation configuration
 * @returns The validated src URL or undefined if validation fails
 */
export function safeGetIframeSrc(htmlString: string): string | undefined {
  try {
    // Create a DOMParser instance
    const parser = new DOMParser();
    // Parse the HTML string
    const doc = parser.parseFromString(htmlString, 'text/html');
    // Get the iframe element
    const iframe = doc.querySelector('iframe');

View on GitHub (pinned to b4c8548c09)

Solutions

1. Provide a valid, absolute embed iframe URL.
2. Validate the URL scheme before embedding.

When it happens

Trigger: Triggered when URL parsing throws while validating an embed iframe URL against allowed protocols and hostnames, causing validation to fail closed and return false.

Common situations: Occurs when a user enters an invalid or malformed URL in the embed iframe block. Enter a full https URL from a supported provider.

AI-assisted analysis of toeverything/AFFiNE@b4c8548c09 (2026-08-18). Data as JSON: /api/errors/8f810be45d567502. Report an issue: GitHub.