From 7919df7ef53d5d2b433c6773cde3d89becd68fb9 Mon Sep 17 00:00:00 2001
From: eux <euxx@users.noreply.github.com>
Date: Fri, 4 Sep 2026 08:17:33 +0000
Subject: [PATCH] fix(api): skip invalid markdown image URLs (#41343)

---
 .../index_processor/index_processor_base.py   | 11 +++++++++-
 .../rag/indexing/test_index_processor_base.py | 21 +++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/api/core/rag/index_processor/index_processor_base.py b/api/core/rag/index_processor/index_processor_base.py
index 7af2c517b84..06bacd68669 100644
--- a/api/core/rag/index_processor/index_processor_base.py
+++ b/api/core/rag/index_processor/index_processor_base.py
@@ -190,7 +190,16 @@ class BaseIndexProcessor(ABC):
                         upload_file_id_list.append(upload_file_id)
                 continue
             if current_user:
-                upload_file_id = self._download_image(image.split(" ")[0], current_user)
+                image_url = image.split(" ")[0]
+                try:
+                    parsed_url = urlparse(image_url)
+                except ValueError:
+                    logging.debug("Skipping malformed image reference: %s", image_url)
+                    continue
+                if parsed_url.scheme not in {"http", "https"} or not parsed_url.netloc:
+                    logging.debug("Skipping non-HTTP image reference: %s", image_url)
+                    continue
+                upload_file_id = self._download_image(image_url, current_user)
                 if upload_file_id:
                     upload_file_id_list.append(upload_file_id)
 
diff --git a/api/tests/unit_tests/core/rag/indexing/test_index_processor_base.py b/api/tests/unit_tests/core/rag/indexing/test_index_processor_base.py
index 6dc66e5ff59..6dc50ba8a08 100644
--- a/api/tests/unit_tests/core/rag/indexing/test_index_processor_base.py
+++ b/api/tests/unit_tests/core/rag/indexing/test_index_processor_base.py
@@ -206,6 +206,27 @@ class TestBaseIndexProcessor:
 
         assert files == []
 
+    def test_get_content_files_skips_invalid_remote_image_references(
+        self, processor: _ForwardingBaseIndexProcessor, unbound_session: Session
+    ) -> None:
+        document = Document(page_content="ignored", metadata={"document_id": "doc-1", "dataset_id": "ds-1"})
+        images = [
+            "document_images/image.png",
+            "//example.com/image.png",
+            "data:image/png;base64,AAAA",
+            "ftp://example.com/image.png",
+            "http://[invalid",
+        ]
+
+        with (
+            patch.object(processor, "_extract_markdown_images", return_value=images),
+            patch.object(processor, "_download_image") as mock_image_download,
+        ):
+            files = processor._get_content_files(document, current_user=Mock(), session=unbound_session)
+
+        assert files == []
+        mock_image_download.assert_not_called()
+
     def test_get_content_files_ignores_missing_upload_records(
         self, processor: _ForwardingBaseIndexProcessor, sqlite_session: Session
     ) -> None: