{"record":{"id":"3ac01140430c964b","repo":"peass-ng/PEASS-ng","slug":"invalid-url","errorCode":null,"errorMessage":"Invalid URL","messagePattern":"Invalid URL","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"metasploit/peass.rb","lineNumber":278,"sourceCode":"    else\n      response.value\n    end\n  end\n \n  def load_peass\n    # Load the PEASS script from a local file or from Internet\n    peass_script = \"\"\n    url_peass = \"\"\n    # If no URL is set, use the default one\n    if datastore['CUSTOM_URL'] != \"\"\n      url_peass = datastore['CUSTOM_URL']\n    else\n      url_peass = datastore['WINPEASS'].to_s.strip.downcase == 'true' ? \"https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEASany_ofs.exe\" : \"https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh\"\n    end\n    # If URL is set, check if it is a valid URL or local file\n    if url_peass.include?(\"http://\") || url_peass.include?(\"https://\")\n      target = URI.parse url_peass\n      raise 'Invalid URL' unless target.scheme =~ /https?/\n      raise 'Invalid URL' if target.host.to_s.eql? ''\n      \n      res = fetch(target)\n      peass_script = res.body\n\n      raise \"Something failed downloading PEASS script from #{url_peass}\" if peass_script.length < 500\n\n    else\n      raise \"PEASS local file (#{url_peass}) does not exist!\" unless ::File.exist?(url_peass)        \n      peass_script = File.read(url_peass)\n      raise \"Something falied reading PEASS script from #{url_peass}\" if peass_script.length < 500\n    end\n\n    return peass_script\n  end\n\n  def aes_enc_peass(peass_script)\n    # Encrypt the PEASS script with AES (CBC Mode)","sourceCodeStart":260,"sourceCodeEnd":296,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/metasploit/peass.rb#L260-L296","documentation":"load_peass() parses the configured PEASS URL with URI.parse and validates that the scheme is http/https and a host is present. A URL failing either check raises 'Invalid URL', guarding against malformed custom WINPEASS/LINPEAS option values.","triggerScenarios":"Running peass with a custom URL in datastore['WINPEASS']/'LINPEAS' that includes http(s):// but has no host (e.g. 'https://') or a non-http scheme after URI.parse (ftp:, file:).","commonSituations":"Typo'd URLs like 'https:/host/path' (single slash), truncated paste of a URL, pointing at a local file path that happens to contain 'http', or scheme typos like 'https//'.","solutions":["Correct the URL to a full http(s) URL including host, e.g. https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh","Validate with URI.parse in Ruby beforehand or curl the URL","If serving a local file, use a local path without http:// instead of the URL mode"],"exampleFix":"# before\nset LINPEAS https:/myhost.local/linpeas.sh\n# after\nset LINPEAS https://myhost.local/linpeas.sh","handlingStrategy":"validation","validationCode":"require 'uri'\nu = URI.parse(datastore['LINPEAS'].to_s)\nraise \"Invalid URL\" unless u.scheme =~ /https?/ && !u.host.to_s.empty?","typeGuard":"def valid_peass_url?(str)\n  return false unless str.is_a?(String) && str.include?('http')\n  u = URI.parse(str) rescue return false\n  u.scheme =~ /https?/ && !u.host.to_s.empty?\nend","tryCatchPattern":"begin\n  target = URI.parse url_peass\n  raise 'Invalid URL' unless target.scheme =~ /https?/ && !target.host.to_s.empty?\nrescue URI::InvalidURIError, RuntimeError => e\n  print_error(\"Bad PEASS URL: #{url_peass} (#{e.message}); using default release URL\")\nend","preventionTips":["Always include scheme (https://) and host in custom URLs","Verify with URI.parse before setting datastore options","Prefer setting only true/false for WINPEASS instead of raw URLs unless serving a custom mirror"],"tags":["http","url-validation","configuration"],"backgroundTag":"invalid-url","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}