fix(cli): Validate regionUrl is absolute to prevent URL parsing errors

Author: sentry[bot]

packages/cli/src/lib/region.ts

@@ -10,6 +10,7 @@ import { getConfiguredSentryUrl } from "./constants.js";
 import { getOrgByNumericId, getOrgRegion, setOrgRegion } from "./db/regions.js";
 import { stripDsnOrgPrefix } from "./dsn/index.js";
 import { withAuthGuard } from "./errors.js";
+import { logger } from "./logger.js";
 import { getSdkConfig } from "./sentry-client.js";
 import { getSentryBaseUrl, isSentrySaasUrl } from "./sentry-urls.js";
 
@@ -85,7 +86,23 @@ async function resolveOrgRegionUncached(orgSlug: string): Promise<string> {
       throw response.error;
     }
 
-    const regionUrl = response.data?.links?.regionUrl || baseUrl;
+    // Validate that the regionUrl is an absolute URL. Self-hosted instances
+    // may return a relative path (e.g. "/") which is truthy but would break
+    // fetch calls that depend on an absolute base URL.
+    const rawRegionUrl = response.data?.links?.regionUrl;
+    let regionUrl: string;
+    try {
+      if (rawRegionUrl && new URL(rawRegionUrl).hostname) {
+        regionUrl = rawRegionUrl;
+      } else {
+        regionUrl = baseUrl;
+      }
+    } catch {
+      logger.debug(
+        `regionUrl "${rawRegionUrl}" from API is not a valid absolute URL; falling back to baseUrl`
+      );
+      regionUrl = baseUrl;
+    }
 
     // Cache for future use. setOrgRegion also extends the in-process
     // trust class so the subsequent request to this region passes the

packages/cli/test/lib/region.test.ts

@@ -203,6 +203,76 @@ describe("resolveOrgRegion", () => {
     }
   });
 
+  test("falls back to baseUrl when API returns a relative regionUrl", async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = async (input: RequestInfo | URL, init?: RequestInit) => {
+      const req = new Request(input, init);
+      if (req.url.includes("/organizations/relative-region-org/")) {
+        return new Response(
+          JSON.stringify({
+            id: "789",
+            slug: "relative-region-org",
+            name: "Self-hosted Org",
+            links: {
+              organizationUrl: "/organizations/relative-region-org/",
+              // Self-hosted instance returns a relative path instead of an absolute URL
+              regionUrl: "/",
+            },
+          }),
+          {
+            status: 200,
+            headers: { "Content-Type": "application/json" },
+          }
+        );
+      }
+      return new Response(JSON.stringify({ detail: "Not found" }), {
+        status: 404,
+      });
+    };
+
+    try {
+      const regionUrl = await resolveOrgRegion("relative-region-org");
+      // Should fall back to the configured baseUrl, not use the relative regionUrl
+      expect(regionUrl).toBe("https://sentry.io");
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  test("falls back to baseUrl when API returns a malformed regionUrl", async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = async (input: RequestInfo | URL, init?: RequestInit) => {
+      const req = new Request(input, init);
+      if (req.url.includes("/organizations/malformed-region-org/")) {
+        return new Response(
+          JSON.stringify({
+            id: "790",
+            slug: "malformed-region-org",
+            name: "Self-hosted Org 2",
+            links: {
+              organizationUrl: "/organizations/malformed-region-org/",
+              regionUrl: "not-a-valid-url",
+            },
+          }),
+          {
+            status: 200,
+            headers: { "Content-Type": "application/json" },
+          }
+        );
+      }
+      return new Response(JSON.stringify({ detail: "Not found" }), {
+        status: 404,
+      });
+    };
+
+    try {
+      const regionUrl = await resolveOrgRegion("malformed-region-org");
+      expect(regionUrl).toBe("https://sentry.io");
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
   test("falls back to default URL when API call fails", async () => {
     // Mock fetch to fail
     const originalFetch = globalThis.fetch;