{"record":{"id":"3c430caed388354a","repo":"composer/composer","slug":"unsupported-s-syntax","errorCode":null,"errorMessage":"unsupported `%s` syntax","messagePattern":"unsupported `(.+?)` syntax","errorType":"validation","errorClass":"\\RuntimeException","httpStatus":null,"severity":"error","filePath":"src/Composer/Util/Http/ProxyItem.php","lineNumber":42,"sourceCode":"    private $safeUrl;\n    /** @var ?non-empty-string */\n    private $curlAuth;\n    /** @var string */\n    private $optionsProxy;\n    /** @var ?non-empty-string */\n    private $optionsAuth;\n\n    /**\n     * @param string $proxyUrl The value from the environment\n     * @param string $envName The name of the environment variable\n     * @throws \\RuntimeException If the proxy url is invalid\n     */\n    public function __construct(string $proxyUrl, string $envName)\n    {\n        $syntaxError = sprintf('unsupported `%s` syntax', $envName);\n\n        if (strpbrk($proxyUrl, \"\\r\\n\\t\") !== false) {\n            throw new \\RuntimeException($syntaxError);\n        }\n        if (false === ($proxy = parse_url($proxyUrl))) {\n            throw new \\RuntimeException($syntaxError);\n        }\n        if (!isset($proxy['host'])) {\n            throw new \\RuntimeException('unable to find proxy host in ' . $envName);\n        }\n\n        $scheme = isset($proxy['scheme']) ? strtolower($proxy['scheme']) . '://' : 'http://';\n        $safe = '';\n\n        if (isset($proxy['user'])) {\n            $safe = '***';\n            $user = $proxy['user'];\n            $auth = rawurldecode($proxy['user']);\n\n            if (isset($proxy['pass'])) {\n                $safe .= ':***';","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/composer/composer/blob/c435d285c9120efdca35696769c72ea9fdcc0466/src/Composer/Util/Http/ProxyItem.php#L24-L60","documentation":"In ProxyItem::__construct, the proxy URL (from HTTP_PROXY/HTTPS_PROXY/etc.) contains a carriage return, newline, or tab character. Composer rejects it outright at src/Composer/Util/Http/ProxyItem.php:42 to prevent CRLF/header-injection through proxy environment variables.","triggerScenarios":"Constructing a ProxyItem (via ProxyManager) when the env var value has embedded `\\r`, `\\n`, or `\\t` — the strpbrk check on line 41 returns non-false.","commonSituations":"Multi-line values in .env files that accidentally include newlines; a CI secret-injection wrapping the value with stray CR/LF; copy-paste from a Windows editor adding CR; a templated value that appended a trailing newline.","solutions":["Strip CR/LF/tab from the proxy env var: `export HTTPS_PROXY=\"$(printf '%s' \"$HTTPS_PROXY\" | tr -d '\\r\\n\\t')\"`.","Re-enter the value in .env/CI secret on a single line with no spanning quotes.","Validate the proxy var at deploy time before invoking Composer."],"exampleFix":"# before (.env, broken across lines)\nHTTPS_PROXY=\"http://proxy.corp.example.com:\\\n8080\"\n\n# after\nHTTPS_PROXY=\"http://proxy.corp.example.com:8080\"","handlingStrategy":"validation","validationCode":"$proxy = getenv('HTTPS_PROXY') ?: '';\nif ($proxy !== '' && strpbrk($proxy, \"\\r\\n\\t\") !== false) {\n    throw new \\InvalidArgumentException('HTTPS_PROXY contains illegal CR/LF/tab characters.');\n}","typeGuard":null,"tryCatchPattern":"try {\n    $proxy = new \\Composer\\Util\\Http\\ProxyItem($val, 'HTTPS_PROXY');\n} catch (\\RuntimeException $e) {\n    if ($e->getMessage() === sprintf('unsupported `%s` syntax', 'HTTPS_PROXY')) {\n        // sanitize the value (strip CR/LF/tab) and retry, or fail fast with guidance\n    }\n    throw $e;\n}","preventionTips":["Keep all proxy env values on a single line.","Audit CI secret stores for stray newline injection.","Add a startup assertion that strips CR/LF/tab from proxy vars."],"tags":["proxy","environment","security","crlf-injection","config"],"backgroundTag":null,"analyzedSha":"c435d285c9120efdca35696769c72ea9fdcc0466","analyzedAt":"2026-08-07T18:58:23.525Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}