wallabag/wallabag · critical · InvalidArgumentException

WALLABAG_ARTICLE_REPORTING_URL must be an absolute HTTPS URL

Error message

WALLABAG_ARTICLE_REPORTING_URL must be an absolute HTTPS URL or a mailto URI with one valid recipient.

What it means

At container-compile time (cache warmup / cache:clear, not at runtime) wallabag validates the WALLABAG_ARTICLE_REPORTING_URL env var through the ArticleReportingUrlPass compiler pass. The value must be either an absolute https:// URL that passes FILTER_VALIDATE_URL and has a host, or a mailto: URI whose path is a syntactically valid email. Anything else — http://, relative paths, mailto: with empty/invalid recipient — throws InvalidArgumentException and the container fails to build.

Source

Thrown at src/DependencyInjection/Compiler/ArticleReportingUrlPass.php:40

        if ('' === $reportingUrl) {
            $reportingUrl = self::DEFAULT_REPORTING_URL;
        }

        $scheme = strtolower((string) parse_url($reportingUrl, \PHP_URL_SCHEME));
        $isValid = false;

        if ('https' === $scheme) {
            $isValid = false !== filter_var($reportingUrl, \FILTER_VALIDATE_URL)
                && '' !== (string) parse_url($reportingUrl, \PHP_URL_HOST);
        } elseif ('mailto' === $scheme) {
            $recipient = parse_url($reportingUrl, \PHP_URL_PATH);
            $isValid = false !== filter_var($reportingUrl, \FILTER_VALIDATE_URL)
                && \is_string($recipient)
                && false !== filter_var(rawurldecode($recipient), \FILTER_VALIDATE_EMAIL);
        }

        if (!$isValid) {
            throw new \InvalidArgumentException(self::INVALID_REPORTING_URL_MESSAGE);
        }

        $container->setParameter(
            'wallabag.article_reporting_url',
            $container->getParameterBag()->escapeValue($reportingUrl)
        );
    }
}

View on GitHub (pinned to efe93850ad)

Solutions

Use an HTTPS absolute URL: WALLABAG_ARTICLE_REPORTING_URL="https://collector.example.com/report"
Or a mailto with exactly one valid recipient: WALLABAG_ARTICLE_REPORTING_URL="mailto:abuse@example.com"
If you do not need reporting, unset/remove the variable entirely instead of leaving a placeholder
Re-run bin/console cache:clear (or redeploy) to confirm the container compiles

Example fix

# before
WALLABAG_ARTICLE_REPORTING_URL="http://collector.example.com/report"
# after
WALLABAG_ARTICLE_REPORTING_URL="https://collector.example.com/report"
# or
WALLABAG_ARTICLE_REPORTING_URL="mailto:abuse@example.com"

Defensive patterns

Strategy: validation

Validate before calling

function isValidReportingUrl(string $url): bool
{
    $scheme = parse_url($url, PHP_URL_SCHEME);
    if ('https' === $scheme) {
        return false !== filter_var($url, FILTER_VALIDATE_URL)
            && '' !== (string) parse_url($url, PHP_URL_HOST);
    }
    if ('mailto' === $scheme) {
        $recipient = parse_url($url, PHP_URL_PATH);

        return false !== filter_var($url, FILTER_VALIDATE_URL)
            && is_string($recipient)
            && false !== filter_var(rawurldecode($recipient), FILTER_VALIDATE_EMAIL);
    }

    return false;
}

if (isset($_ENV['WALLABAG_ARTICLE_REPORTING_URL']) && !isValidReportingUrl($_ENV['WALLABAG_ARTICLE_REPORTING_URL'])) {
    throw new InvalidArgumentException('WALLABAG_ARTICLE_REPORTING_URL must be https://… or mailto:user@example.com');
}

Try / catch

try {
    $process->run('bin/console cache:clear');
} catch (ProcessFailedException $e) {
    if (str_contains($e->getMessage(), 'WALLABAG_ARTICLE_REPORTING_URL')) {
        // unset the var or set a valid https:// / mailto: value, then clear cache again
    }
}

Prevention

Use absolute https:// URLs or mailto:one-valid-recipient for WALLABAG_ARTICLE_REPORTING_URL
Never leave placeholder values in env files — unset the var instead
Validate the env var in CI before deploying so cache warmup cannot fail in production
Remember this fails at container build (cache:clear), not at request time

When it happens

Trigger: Setting WALLABAG_ARTICLE_REPORTING_URL=http://collector.example.com/report; a bare 'collector.example.com'; 'mailto:' without an address; 'mailto:user@invalid..com'; then running composer install or bin/console cache:clear.

Common situations: Ops teams pointing article-abuse reporting at an internal HTTP endpoint (TLS not yet set up); copy/pasting an email with query params into the mailto form; deploying with the var defined globally in the shell so it leaks into cache rebuilds.

Related errors

AI-assisted analysis of wallabag/wallabag@efe93850ad (2026-08-21). Data as JSON: /api/errors/815e8384d8391ab7. Report an issue: GitHub.