zeroclaw-labs/zeroclaw · error

URL cannot contain whitespace

Error message

URL cannot contain whitespace

What it means

After trimming, browser_open rejects any URL containing an internal whitespace character — space, tab, newline, or unicode spaces (char::is_whitespace). Spaces break URL parsing and are a classic injection vector, so the guard fails closed rather than silently encoding the URL for the caller.

Source

Thrown at crates/zeroclaw-tools/src/browser_open.rs:51

                allowed_domains,
                "browser.allowed_domains",
            )?,
            allowed_private_hosts: domain_guard::normalize_allowed_domains(
                allowed_private_hosts,
                "browser.allowed_private_hosts",
            )?,
        })
    }

    fn validate_url(&self, raw_url: &str) -> anyhow::Result<String> {
        let url = raw_url.trim();

        if url.is_empty() {
            anyhow::bail!("URL cannot be empty");
        }

        if url.chars().any(char::is_whitespace) {
            anyhow::bail!("URL cannot contain whitespace");
        }

        if !(url.starts_with("https://") || url.starts_with("http://")) {
            anyhow::bail!("Only http:// or https:// URLs are allowed");
        }

        if self.allowed_domains.is_empty() && self.allowed_private_hosts.is_empty() {
            anyhow::bail!(
                "Browser tool is enabled but no allowed_domains are configured. Add [browser].allowed_domains in config.toml"
            );
        }

        let host = extract_host(url)?;
        let private_host = domain_guard::is_private_or_local_host(&host);
        let private_host_allowed = private_host
            && domain_guard::host_matches_allowlist(&host, &self.allowed_private_hosts);

        if private_host && !private_host_allowed {

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Percent-encode spaces (%20) or the whole path component
2. Strip internal whitespace before calling, e.g. url.split_whitespace().next()
3. Build URLs with a URL library instead of string concatenation

Example fix

// before
{"url": "https://example.com/my file.png"}
// after
{"url": "https://example.com/my%20file.png"}

let url = raw_url.trim();
if url.chars().any(char::is_whitespace) {
    return Err("URL contains internal whitespace; percent-encode it".into());
}

match open_tool.execute(args).await {
    Ok(res) if res.success => { /* ... */ }
    Ok(res) => {
        if res.error.as_deref().unwrap_or_default().contains("whitespace") {
            // percent-encode the URL and retry
        }
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: url="https://example.com/my file.png" (unencoded space), or a URL carrying an embedded tab/newline from templates or clipboard paste that survives trimming because it sits in the middle.

Common situations: Unencoded spaces in filenames and paths; copy-paste from PDFs or chat introducing unicode spaces (U+00A0); string concatenation joining a URL and a caption.

Related errors

• URL cannot contain whitespace
• URL cannot be empty
• Only http:// or https:// URLs are allowed
• URL cannot contain whitespace
• providers.models.{profile_name}.uri must use http/https

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/ff9e19bae0d5a203. Report an issue: GitHub.