{"record":{"id":"0bdf8fe75fe6860d","repo":"googleapis/mcp-toolbox","slug":"error-parsing-url-path-s","errorCode":null,"errorMessage":"error parsing URL path: %s","messagePattern":"error parsing URL path: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/tools/http/http.go","lineNumber":200,"sourceCode":"\t}\n\tvar templatedPath bytes.Buffer\n\terr = templ.Execute(&templatedPath, pathParamsMap)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"error replacing pathParams: %s\", err)\n\t}\n\n\tbaseParsedURL, err := url.Parse(baseURL)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"error parsing base URL: %s\", err)\n\t}\n\tif baseParsedURL.Scheme == \"\" || baseParsedURL.Host == \"\" {\n\t\treturn \"\", fmt.Errorf(\"base URL must include scheme and host\")\n\t}\n\n\trelativePath := templatedPath.String()\n\trelParsedURL, err := url.Parse(relativePath)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"error parsing URL path: %s\", err)\n\t}\n\tif relParsedURL.Scheme != \"\" || relParsedURL.Host != \"\" || relParsedURL.User != nil {\n\t\treturn \"\", fmt.Errorf(\"path must be relative and cannot override base host\")\n\t}\n\n\t// Reject dot segments before resolution\n\tfor _, segment := range strings.Split(relParsedURL.Path, \"/\") {\n\t\tif segment == \"..\" {\n\t\t\treturn \"\", fmt.Errorf(\"path cannot contain dot segments (..)\")\n\t\t}\n\t}\n\n\t// Create URL based on BaseURL and Path\n\t// Attach query parameters\n\tparsedURL := baseParsedURL.ResolveReference(relParsedURL)\n\n\t// Verify final path stays within base path scope\n\tbasePath := baseParsedURL.Path","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/tools/http/http.go#L182-L218","documentation":"The templated tool path must parse as a relative URL: getURL parses the rendered path with net/url.Parse and wraps any parse failure as \"error parsing URL path\". Failures here indicate the path (after parameter substitution) is not a valid URL reference.","triggerScenarios":"A rendered path containing invalid characters — e.g. raw spaces, invalid percent-escapes like \"%zz\", or control characters injected via an unsanitized path param — makes url.Parse of the relative path fail during Invoke.","commonSituations":"User/LLM-supplied path parameter values containing spaces or malformed escapes interpolated into the path without pathEscape; copy-pasted paths with trailing whitespace or invisible characters.","solutions":["Wrap path-param interpolations with the provided \"pathEscape\" template function, e.g. {{.id | pathEscape}}.","Sanitize or reject invalid characters in path param values before invocation.","Check the tool's static \"path\" for typos such as malformed percent-encodings or stray whitespace."],"exampleFix":"// before\npath: \"/files/{{.name}}\"\n// after\npath: \"/files/{{.name | pathEscape}}\"","handlingStrategy":"validation","validationCode":"// Verify rendered path parses as a relative URL before invoking\nrel, err := url.Parse(renderedPath)\nif err != nil {\n    return fmt.Errorf(\"rendered path %q is not a valid URL reference: %w\", renderedPath, err)\n}","typeGuard":null,"tryCatchPattern":"urlString, err := getURL(baseURL, path, pathParams, queryParams, defaultQuery, paramsMap)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"error parsing URL path\") {\n        return nil, fmt.Errorf(\"rendered path invalid; check path param values: %w\", err)\n    }\n    return nil, err\n}","preventionTips":["Apply pathEscape to every interpolated path param value","Reject or sanitize spaces, control characters, and invalid %-sequences in param values","Smoke-test each http tool with edge-case param values (spaces, unicode, slashes)"],"tags":["go","http","url","template"],"backgroundTag":"invalid-url-format","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}