{"record":{"id":"3062ba54aba31a09","repo":"abhigyanpatwari/GitNexus","slug":"only-https-and-http-git-urls-are-allowed-3062ba","errorCode":null,"errorMessage":"Only https:// and http:// git URLs are allowed","messagePattern":"Only https:// and http:// git URLs are allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"gitnexus/src/core/net/url-guard.ts","lineNumber":25,"sourceCode":"  'metadata.azure.com',\n  'metadata.internal',\n]);\n\n/**\n * Validate an outbound http(s) URL to prevent SSRF.\n * Only allows https:// and http:// schemes. Blocks private/internal addresses,\n * IPv6 private ranges, cloud metadata hostnames, and numeric IP encodings.\n */\nexport function validateGitUrl(url: string): void {\n  let parsed: URL;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error('Invalid URL');\n  }\n\n  if (!['https:', 'http:'].includes(parsed.protocol)) {\n    throw new Error('Only https:// and http:// git URLs are allowed');\n  }\n\n  if (parsed.search || parsed.hash) {\n    throw new Error('Git URLs must not include query strings or fragments');\n  }\n\n  const host = parsed.hostname.toLowerCase();\n\n  // Block known dangerous hostnames (cloud metadata services)\n  if (BLOCKED_HOSTNAMES.has(host)) {\n    throw new Error('Cloning from private/internal addresses is not allowed');\n  }\n\n  // Strip IPv6 brackets if present (URL parser behavior varies across Node versions)\n  let normalizedHost = host;\n  if (host.startsWith('[') && host.endsWith(']')) {\n    normalizedHost = host.slice(1, -1);\n  }","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/0d1aed942f0e8b5d3bac27519fff441aceea722d/gitnexus/src/core/net/url-guard.ts#L7-L43","documentation":"validateGitUrl restricts git URLs to the https: and http: protocols. URLs parsed with any other scheme (ssh:, git:, file:, ftp:) are rejected. This is part of the network guard that prevents the tool from fetching arbitrary-protocol resources or local files.","triggerScenarios":"Calling validateGitUrl (or cloneOrPull / normalizedRegistry / sanitizedHttpUrl) with a URL whose parsed.protocol is not http/https — e.g. ssh://git@github.com/acme/api.git, git://..., file:///path/to/repo.","commonSituations":"Using an SSH remote URL from `git remote -v` output; a git:// protocol URL from old docs; a file:// URL for a local clone; internal remotes configured with ssh scheme.","solutions":["Rewrite SSH remotes to https: ssh://git@github.com/acme/api.git → https://github.com/acme/api.git.","Replace git:// URLs with their https:// equivalents (the protocol is deprecated on most hosts).","For local repos, use the local-path API instead of the HTTP-based clone flow.","If you control the config, normalize all remotes to https at ingestion time."],"exampleFix":"// before\nvalidateGitUrl('ssh://git@github.com/acme/api.git');\n\n// after\nvalidateGitUrl('https://github.com/acme/api.git');","handlingStrategy":"validation","validationCode":"const p = new URL(u);\nif (p.protocol !== 'https:' && p.protocol !== 'http:') {\n  throw new Error(`unsupported scheme ${p.protocol}; use https://`);\n}","typeGuard":"const isHttpGitUrl = (u: string): boolean => {\n  try { return ['https:', 'http:'].includes(new URL(u).protocol); } catch { return false; }\n};","tryCatchPattern":"try {\n  validateGitUrl(url);\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith('Only https:// and http://')) {\n    throw new Error(`rewrite ${url} to its https:// form`);\n  }\n  throw err;\n}","preventionTips":["Normalize ssh:// and git:// remotes to https at ingestion.","Use credential helpers instead of SSH URLs when the tool requires http(s).","Document that only http(s) remotes are supported by this flow."],"tags":["url","validation","git","protocol","ssrf-guard"],"backgroundTag":"invalid-url-format","analyzedSha":"0d1aed942f0e8b5d3bac27519fff441aceea722d","analyzedAt":"2026-09-08T00:40:44.970Z","contentChangedAt":"2026-09-08T00:40:44.970Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}