fix(api): skip invalid markdown image URLs (#41343)

api/core/rag/index_processor/index_processor_base.py

@@ -190,7 +190,16 @@ class BaseIndexProcessor(ABC):
                         upload_file_id_list.append(upload_file_id)
                 continue
             if current_user:
-                upload_file_id = self._download_image(image.split(" ")[0], current_user)
+                image_url = image.split(" ")[0]
+                try:
+                    parsed_url = urlparse(image_url)
+                except ValueError:
+                    logging.debug("Skipping malformed image reference: %s", image_url)
+                    continue
+                if parsed_url.scheme not in {"http", "https"} or not parsed_url.netloc:
+                    logging.debug("Skipping non-HTTP image reference: %s", image_url)
+                    continue
+                upload_file_id = self._download_image(image_url, current_user)
                 if upload_file_id:
                     upload_file_id_list.append(upload_file_id)
 

api/tests/unit_tests/core/rag/indexing/test_index_processor_base.py

@@ -206,6 +206,27 @@ class TestBaseIndexProcessor:
 
         assert files == []
 
+    def test_get_content_files_skips_invalid_remote_image_references(
+        self, processor: _ForwardingBaseIndexProcessor, unbound_session: Session
+    ) -> None:
+        document = Document(page_content="ignored", metadata={"document_id": "doc-1", "dataset_id": "ds-1"})
+        images = [
+            "document_images/image.png",
+            "//example.com/image.png",
+            "data:image/png;base64,AAAA",
+            "ftp://example.com/image.png",
+            "http://[invalid",
+        ]
+
+        with (
+            patch.object(processor, "_extract_markdown_images", return_value=images),
+            patch.object(processor, "_download_image") as mock_image_download,
+        ):
+            files = processor._get_content_files(document, current_user=Mock(), session=unbound_session)
+
+        assert files == []
+        mock_image_download.assert_not_called()
+
     def test_get_content_files_ignores_missing_upload_records(
         self, processor: _ForwardingBaseIndexProcessor, sqlite_session: Session
     ) -> None: