{"record":{"id":"1f61c3df93ef77bb","repo":"epi052/feroxbuster","slug":"the-url-matches-the-scan-will-never-start","errorCode":null,"errorMessage":"The url '{}' matches {}; the scan will never start","messagePattern":"The url '(.+?)' matches (.+?); the scan will never start","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/main.rs","lineNumber":195,"sourceCode":"        };\n    } else {\n        targets.push(handles.config.target_url.clone());\n    }\n\n    // remove footgun that arises if a --dont-scan value matches on a base url\n    for target in targets.iter_mut() {\n        for denier in &handles.config.regex_denylist {\n            if denier.is_match(target) {\n                bail!(\n                    \"The regex '{}' matches {}; the scan will never start\",\n                    denier,\n                    target\n                );\n            }\n        }\n        for denier in &handles.config.url_denylist {\n            if denier.as_str().trim_end_matches('/') == target.trim_end_matches('/') {\n                bail!(\n                    \"The url '{}' matches {}; the scan will never start\",\n                    denier,\n                    target\n                );\n            }\n        }\n\n        if !target.starts_with(\"http\") {\n            // --url hackerone.com\n            // as of the 2.13.0 update, config::container handles both --url hackerone.com\n            // and urls coming in from --stdin. I think this is dead code now, but leaving\n            // it in just in case\n            *target = format!(\"{}://{target}\", handles.config.protocol);\n        }\n    }\n\n    log::trace!(\"exit: get_targets -> {targets:?}\");\n","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/epi052/feroxbuster/blob/1f595dab5c76858d5a14fbc47dabf2563d729c62/src/main.rs#L177-L213","documentation":"Companion to the regex check: get_targets compares each target against every entry in the URL denylist (--dont-scan with URL values) after trimming trailing slashes; an exact match means the base target itself would be denied, so the scan would never run and it bails. It protects against denying the very target being scanned.","triggerScenarios":"Passing --dont-scan <url> where the value equals the base target modulo a trailing slash, e.g. ferox -u https://example.com --dont-scan https://example.com/","commonSituations":"Copy-pasting the target URL into the dont-scan list by mistake, or building denylists from previous scan output that includes the root URL.","solutions":["Remove the denylist entry identical to the base target","Use a more specific subpath (e.g. https://example.com/admin) instead of the root URL","Check the denylist for duplicates of the -u value, ignoring trailing slashes"],"exampleFix":"// before\nferox -u https://example.com --dont-scan https://example.com/\n// after\nferox -u https://example.com --dont-scan https://example.com/static","handlingStrategy":"validation","validationCode":"const norm = u => u.replace(/\\/+$/, ''); if (denyUrls.some(d => norm(d) === norm(targetUrl))) throw new Error('dont-scan url equals target');","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never add the base target itself to the URL denylist","Compare ignoring trailing slashes when curating denylists","Audit denylists generated from prior scan output"],"tags":["configuration","cli","url","footgun"],"backgroundTag":"conflicting-config-options","analyzedSha":"1f595dab5c76858d5a14fbc47dabf2563d729c62","analyzedAt":"2026-09-13T19:33:06.208Z","contentChangedAt":"2026-09-13T19:33:06.208Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}