{"record":{"id":"397cb5ded4d421ea","repo":"golang/go","slug":"no-explicit-url-was-passed","errorCode":null,"errorMessage":"no explicit url was passed","messagePattern":"no explicit url was passed","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/auth/gitauth.go","lineNumber":38,"sourceCode":"\t\"net/url\"\n\t\"os/exec\"\n\t\"strings\"\n)\n\nconst maxTries = 3\n\n// runGitAuth retrieves credentials for the given url using\n// 'git credential fill', validates them with a HEAD request\n// (using the provided client) and updates the credential helper's cache.\n// It returns the matching credential prefix, the http.Header with the\n// Basic Authentication header set, or an error.\n// The caller must not mutate the header.\nfunc runGitAuth(client *http.Client, dir, url string) (string, http.Header, error) {\n\tif url == \"\" {\n\t\t// No explicit url was passed, but 'git credential'\n\t\t// provides no way to enumerate existing credentials.\n\t\t// Wait for a request for a specific url.\n\t\treturn \"\", nil, fmt.Errorf(\"no explicit url was passed\")\n\t}\n\tif dir == \"\" {\n\t\t// Prevent config-injection attacks by requiring an explicit working directory.\n\t\t// See https://golang.org/issue/29230 for details.\n\t\tpanic(\"'git' invoked in an arbitrary directory\") // this should be caught earlier.\n\t}\n\tcmd := exec.Command(\"git\", \"credential\", \"fill\")\n\tcmd.Dir = dir\n\tcmd.Stdin = strings.NewReader(fmt.Sprintf(\"url=%s\\n\", url))\n\tout, err := cmd.CombinedOutput()\n\tif err != nil {\n\t\treturn \"\", nil, fmt.Errorf(\"'git credential fill' failed (url=%s): %w\\n%s\", url, err, out)\n\t}\n\tparsedPrefix, username, password := parseGitAuth(out)\n\tif parsedPrefix == \"\" {\n\t\treturn \"\", nil, fmt.Errorf(\"'git credential fill' failed for url=%s, could not parse url\\n\", url)\n\t}\n\t// Check that the URL Git gave us is a prefix of the one we requested.","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/auth/gitauth.go#L20-L56","documentation":"Returned by runGitAuth when the url argument is empty, because `git credential` provides no way to enumerate stored credentials and therefore needs an explicit URL. The standard caller (runGoAuth) guards this case with `if url == \"\" { continue }` before invoking runGitAuth, so under normal use of the go command this error is not reached. It exists as a defensive contract for direct callers of runGitAuth.","triggerScenarios":"runGitAuth is invoked with url == \"\". Reachable only if an internal caller bypasses the guard in auth.go (a regression or a third-party tool calling the unexported function via a fork).","commonSituations":"End users of the go command should not encounter this. It would surface only from a buggy internal caller or a forked/maintained version that drops the url guard.","solutions":["Do not call runGitAuth with an empty url; guard the caller: `if url == \"\" { return }` before the call.","Rely on the go command's built-in GOAUTH=git handling rather than invoking gitauth internals directly."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// If calling runGitAuth directly, guard the empty-url case first.\nif url == \"\" {\n    return \"\", nil, errors.New(\"runGitAuth requires a non-empty url\")\n}\nreturn runGitAuth(client, dir, url)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always check `url != \"\"` before calling runGitAuth.","Prefer the go command's built-in GOAUTH=git handling over calling internals."],"tags":["go-toolchain","goauth","git","authentication","internal","defensive"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}