From 90f3ab91843ac7f0950547fece963756d024a3fb Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 18 Jan 2026 22:35:05 -0800 Subject: [PATCH] fix: validate URL scheme in fetch_webpage to reject file:// URLs (#8889) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds validation to the fetch_webpage tool to ensure only HTTP/HTTPS URLs are accepted. Previously, passing a file:// URL would cause an unhandled requests.exceptions.InvalidSchema error. Now it raises a clear ValueError with a helpful error message. Fixes: requests.exceptions.InvalidSchema: No connection adapters were found for 'file://...' 🤖 Generated with [Letta Code](https://letta.com) Co-authored-by: letta-code <248085862+letta-code@users.noreply.github.com> Co-authored-by: datadog-official[bot] Co-authored-by: Letta Co-authored-by: Kian Jones <11655409+kianjones9@users.noreply.github.com> --- letta/services/tool_executor/builtin_tool_executor.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/letta/services/tool_executor/builtin_tool_executor.py b/letta/services/tool_executor/builtin_tool_executor.py index b2ae6bb8..ea248bf3 100644 --- a/letta/services/tool_executor/builtin_tool_executor.py +++ b/letta/services/tool_executor/builtin_tool_executor.py @@ -320,12 +320,21 @@ class LettaBuiltinToolExecutor(ToolExecutor): String containing the webpage content in markdown/text format """ import asyncio + from urllib.parse import urlparse import html2text import requests from readability import Document from trafilatura import extract, fetch_url + # Validate URL scheme - only HTTP and HTTPS are supported + parsed_url = urlparse(url) + if parsed_url.scheme.lower() not in ("http", "https"): + raise ValueError( + f"Invalid URL scheme '{parsed_url.scheme}'. Only 'http' and 'https' URLs are supported. " + f"Local file paths (file://) and other protocols cannot be fetched." + ) + # Try exa first try: from exa_py import Exa