{"record":{"id":"1925a6de9367cdb4","repo":"windmill-labs/windmill","slug":"invalid-slack-authorization-url-e","errorCode":null,"errorMessage":"Invalid Slack authorization URL: {e}","messagePattern":"Invalid Slack authorization URL: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/windmill-oauth/src/lib.rs","lineNumber":365,"sourceCode":"    if config.req_body_auth.unwrap_or(false) {\n        client.set_auth_type(AuthType::RequestBody);\n    }\n    client.set_client_secret(client_params.secret.clone());\n    client.set_redirect_url(\n        Url::parse(&redirect_url).map_err(|e| anyhow!(\"Invalid redirect URL: {e}\"))?,\n    );\n\n    Ok((name.to_string(), client))\n}\n\n/// Build a Slack OAuth client with custom credentials\npub async fn build_slack_client(\n    client_id: &str,\n    client_secret: &str,\n    _workspace_id: &str,\n) -> error::Result<OClient> {\n    let auth_url = Url::parse(\"https://slack.com/oauth/v2/authorize\")\n        .map_err(|e| anyhow!(\"Invalid Slack authorization URL: {e}\"))?;\n    let token_url = Url::parse(\"https://slack.com/api/oauth.v2.access\")\n        .map_err(|e| anyhow!(\"Invalid Slack token URL: {e}\"))?;\n\n    let base_url = (**BASE_URL.load()).clone();\n    let redirect_url = format!(\"{}/oauth/callback_slack\", base_url);\n\n    let mut client = OClient::new(client_id.to_string(), auth_url, token_url);\n    client.set_client_secret(client_secret.to_string());\n    client.set_redirect_url(\n        Url::parse(&redirect_url).map_err(|e| anyhow!(\"Invalid redirect URL: {e}\"))?,\n    );\n\n    Ok(client)\n}\n\n/// Build OAuth client for client credentials flow with resource-level credentials.\n///\n/// No instance-level entry is required: the provider endpoint config resolves","sourceCodeStart":347,"sourceCodeEnd":383,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/backend/windmill-oauth/src/lib.rs#L347-L383","documentation":"build_slack_client hardcodes the Slack authorization endpoint https://slack.com/oauth/v2/authorize and parses it with Url::parse. Since the literal is a valid URL, this error is practically unreachable and only fires if the constant is edited or a build-time transformation corrupts it.","triggerScenarios":"Only from a modified/patched source where the hardcoded Slack authorize URL literal was changed to an unparseable value; normal operation of build_slack_client cannot trigger it.","commonSituations":"Internal forks or codegen patches altering hardcoded URLs; essentially never seen in production.","solutions":["Restore the hardcoded URL to the exact literal https://slack.com/oauth/v2/authorize","If seen in a fork, diff windmill-oauth/src/lib.rs against upstream to find the corrupted constant"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match build_slack_client(id, secret, workspace_id).await {\n    Ok(c) => c,\n    Err(e) if e.to_string().contains(\"Invalid Slack authorization URL\") => unreachable!(\"hardcoded URL corrupted\"),\n    Err(e) => return Err(e),\n}","preventionTips":["Do not modify hardcoded provider endpoint constants in forks without re-running URL validation","Track upstream changes to windmill-oauth in internal patches"],"tags":["oauth","slack","url-parsing"],"backgroundTag":"invalid-url-format","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}