usememos/memos · warning

only http/https protocols are allowed

Error message

only http/https protocols are allowed

What it means

validateURL rejects any scheme other than http or https. This blocks file://, ftp://, gopher://, data:, and similar schemes from being fetched by the metadata scraper, a standard SSRF hardening measure.

Source

Thrown at internal/httpgetter/html_meta.go:115

	if len(ips) == 0 {
		return nil, errors.New("hostname resolved to no addresses")
	}

	return ips, nil
}

func isInternalIP(ip net.IP) bool {
	return ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() || ip.IsUnspecified()
}

func validateURL(urlStr string) error {
	u, err := url.Parse(urlStr)
	if err != nil {
		return errors.New("invalid URL format")
	}

	if u.Scheme != "http" && u.Scheme != "https" {
		return errors.New("only http/https protocols are allowed")
	}

	host := u.Hostname()
	if host == "" {
		return errors.New("empty hostname")
	}

	if ip := net.ParseIP(host); ip != nil && isInternalIP(ip) {
		return errors.Wrap(ErrInternalIP, ip.String())
	}

	return nil
}

type HTMLMeta struct {
	Title       string `json:"title"`
	Description string `json:"description"`
	Image       string `json:"image"`

View on GitHub (pinned to 14d757ce1f)

Solutions

1. Only submit http:// or https:// URLs to the fetcher
2. Strip or reject non-web links client-side before calling preview APIs
3. If you need local file content, upload it as an attachment instead of link preview

Example fix

// before
GetHTMLMeta("file:///home/user/doc.html")
// after
GetHTMLMeta("https://example.com/doc.html")

func isWebURL(u *url.URL) bool { return u.Scheme == "http" || u.Scheme == "https" }

// gate before fetch:
if u, err := url.Parse(raw); err != nil || !isWebURL(u) { return nil }

// Skip previews for non-web schemes rather than erroring
if err := fetchPreview(u); err != nil {
  if strings.Contains(err.Error(), "only http/https") { return nil }
  return err
}

When it happens

Trigger: Passing `file:///etc/passwd`, `ftp://host/file`, `data:text/html,...`, or any non-http(s) URL to the HTML metadata getter; also fires on redirect targets with odd schemes.

Common situations: Users pasting local file links or protocol links into memos; automated tooling feeding arbitrary user text into the preview endpoint; iOS/Android app share sheets producing unusual URI schemes.

Related errors

• internal IP addresses are not allowed
• hostname resolved to no addresses
• invalid URL format
• empty hostname
• The signed-in user changed before the OAuth callback complet

AI-assisted analysis of usememos/memos@14d757ce1f (2026-08-15). Data as JSON: /api/errors/de94f6d2302e7677. Report an issue: GitHub.