abhigyanpatwari/GitNexus · error · Error

Backend URL must use http:// or https:// (got ${parsed.proto

Error message

Backend URL must use http:// or https:// (got ${parsed.protocol})

What it means

Thrown by validateBackendUrl() when the URL parses successfully but uses a protocol other than http: or https: (e.g. javascript:, data:, file:, ftp:). This is a CodeQL js/client-side-request-forgery guard: only the scheme is echoed in the message (parsed.protocol), never the full URL, to avoid leaking embedded credentials. The client intentionally accepts any well-formed http/https origin, including remote hosts — localhost is not required.

Source

Thrown at gitnexus-web/src/services/backend-client.ts:304

/**
 * Validate that a backend URL is a safe http:// or https:// origin before
 * storing it as the fetch target base (CodeQL js/client-side-request-forgery).
 *
 * Throws if the URL uses a non-HTTP scheme (e.g. javascript:, data:, file://).
 * All other well-formed http/https URLs are accepted — the client intentionally
 * supports connecting to remote GitNexus servers, not just localhost.
 */
export function validateBackendUrl(url: string): void {
  let parsed: URL;
  try {
    parsed = new URL(url);
  } catch {
    // Do not echo raw input — it may contain credentials.
    throw new Error('Invalid backend URL: must be a well-formed http:// or https:// URL');
  }
  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
    // Use parsed.protocol only (scheme), not the full URL, to avoid leaking credentials.
    throw new Error(`Backend URL must use http:// or https:// (got ${parsed.protocol})`);
  }
}

export const setBackendUrl = (url: string): void => {
  const trimmed = url.replace(/\/$/, '');
  validateBackendUrl(trimmed);
  _backendUrl = trimmed;
};

export const getBackendUrl = (): string => _backendUrl;

/**
 * Normalize a user-entered server URL into a base URL suitable for setBackendUrl().
 * Adds protocol if missing, strips trailing slashes, and strips a trailing /api suffix
 * (since all API methods append their own /api/... paths to _backendUrl).
 */
export function normalizeServerUrl(input: string): string {
  let url = input.trim().replace(/\/+$/, '');

View on GitHub (pinned to d540b00184)

Solutions

1. Use only http:// or https:// URLs for the backend
2. For local development use 'http://localhost:4747' (or 'http://127.0.0.1:4747')
3. Reject user-supplied URLs that aren't http/https at the input layer before they reach setBackendUrl
4. If connecting to a remote GitNexus server, use its https:// origin

Example fix

// before — non-http scheme
setBackendUrl('file:///srv/gitnexus'); // throws '...must use http:// or https://...'

// after — valid http(s) URL
setBackendUrl('http://localhost:4747');

function isSafeHttpUrl(url: string): boolean {
  let parsed: URL;
  try { parsed = new URL(url); } catch { return false; }
  return parsed.protocol === 'http:' || parsed.protocol === 'https:';
}
if (!isSafeHttpUrl(input)) {
  throw new Error('Backend URL must be http:// or https://');
}

function isHttpUrl(s: string): boolean {
  try { const u = new URL(s); return u.protocol === 'http:' || u.protocol === 'https:'; }
  catch { return false; }
}

try {
  setBackendUrl(input);
} catch (e) {
  if (e instanceof Error && /must use http:// or https:///.test(e.message)) {
    // non-http scheme (javascript:, data:, file:) — reject at the input layer
    showUserError('Only http:// or https:// backend URLs are allowed');
  }
  throw e;
}

When it happens

Trigger: Calling setBackendUrl(url)/validateBackendUrl(url) where url is 'javascript:alert(1)', 'data:text/html,...', 'file:///etc/passwd', 'ftp://host', etc. The URL constructor succeeds but protocol check fails.

Common situations: A malicious or malformed input reached the backend URL field (XSS attempt via javascript:); a file:// path pasted by mistake; a test fixture using a non-http scheme; an attacker probing the client-side request surface.

Related errors

• LLM base URL must use http:// or https:// (got ${parsed.prot
• Invalid backend URL: must be a well-formed http:// or https:
• Invalid LLM base URL: must be a well-formed http:// or https
• ${source}: value contains control or hidden/bidirectional ch
• ${source}: branch name contains characters not allowed in a

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/07c0cfd460cd1625. Report an issue: GitHub.