abhigyanpatwari/GitNexus · error

Only https:// and http:// git URLs are allowed

Error message

Only https:// and http:// git URLs are allowed

What it means

validateGitUrl restricts git URLs to the https: and http: protocols. URLs parsed with any other scheme (ssh:, git:, file:, ftp:) are rejected. This is part of the network guard that prevents the tool from fetching arbitrary-protocol resources or local files.

Source

Thrown at gitnexus/src/core/net/url-guard.ts:25

  'metadata.azure.com',
  'metadata.internal',
]);

/**
 * Validate an outbound http(s) URL to prevent SSRF.
 * Only allows https:// and http:// schemes. Blocks private/internal addresses,
 * IPv6 private ranges, cloud metadata hostnames, and numeric IP encodings.
 */
export function validateGitUrl(url: string): void {
  let parsed: URL;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error('Invalid URL');
  }

  if (!['https:', 'http:'].includes(parsed.protocol)) {
    throw new Error('Only https:// and http:// git URLs are allowed');
  }

  if (parsed.search || parsed.hash) {
    throw new Error('Git URLs must not include query strings or fragments');
  }

  const host = parsed.hostname.toLowerCase();

  // Block known dangerous hostnames (cloud metadata services)
  if (BLOCKED_HOSTNAMES.has(host)) {
    throw new Error('Cloning from private/internal addresses is not allowed');
  }

  // Strip IPv6 brackets if present (URL parser behavior varies across Node versions)
  let normalizedHost = host;
  if (host.startsWith('[') && host.endsWith(']')) {
    normalizedHost = host.slice(1, -1);
  }

View on GitHub (pinned to 0d1aed942f)

Solutions

1. Rewrite SSH remotes to https: ssh://git@github.com/acme/api.git → https://github.com/acme/api.git.
2. Replace git:// URLs with their https:// equivalents (the protocol is deprecated on most hosts).
3. For local repos, use the local-path API instead of the HTTP-based clone flow.
4. If you control the config, normalize all remotes to https at ingestion time.

Example fix

// before
validateGitUrl('ssh://git@github.com/acme/api.git');

// after
validateGitUrl('https://github.com/acme/api.git');

const p = new URL(u);
if (p.protocol !== 'https:' && p.protocol !== 'http:') {
  throw new Error(`unsupported scheme ${p.protocol}; use https://`);
}

const isHttpGitUrl = (u: string): boolean => {
  try { return ['https:', 'http:'].includes(new URL(u).protocol); } catch { return false; }
};

try {
  validateGitUrl(url);
} catch (err) {
  if (err instanceof Error && err.message.startsWith('Only https:// and http://')) {
    throw new Error(`rewrite ${url} to its https:// form`);
  }
  throw err;
}

When it happens

Trigger: Calling validateGitUrl (or cloneOrPull / normalizedRegistry / sanitizedHttpUrl) with a URL whose parsed.protocol is not http/https — e.g. ssh://git@github.com/acme/api.git, git://..., file:///path/to/repo.

Common situations: Using an SSH remote URL from `git remote -v` output; a git:// protocol URL from old docs; a file:// URL for a local clone; internal remotes configured with ssh scheme.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• Invalid URL
• Git URLs must not include query strings or fragments
• Invalid URL
• Only https:// and http:// git URLs are allowed
• must not include query strings or fragments

AI-assisted analysis of abhigyanpatwari/GitNexus@0d1aed942f (2026-09-08). Data as JSON: /api/errors/3062ba54aba31a09. Report an issue: GitHub.