{"record":{"id":"45bb351de42c5f8b","repo":"badges/shields","slug":"invalid-url-parameter","errorCode":null,"errorMessage":"invalid url parameter","messagePattern":"invalid url parameter","errorType":"validation","errorClass":"InvalidParameter","httpStatus":null,"severity":"error","filePath":"core/base-service/auth-helper.js","lineNumber":103,"sourceCode":"    const strictSSL = options?.https?.rejectUnauthorized ?? true\n    return strictSSL !== true\n  }\n\n  enforceStrictSsl({ options = {} }) {\n    if (\n      this._requireStrictSsl &&\n      this.constructor._isInsecureSslRequest({ options })\n    ) {\n      throw new InvalidParameter({ prettyMessage: 'strict ssl is required' })\n    }\n  }\n\n  isAllowedOrigin(url) {\n    let parsed\n    try {\n      parsed = new URL(url)\n    } catch (e) {\n      throw new InvalidParameter({ prettyMessage: 'invalid url parameter' })\n    }\n\n    const { protocol, host } = parsed\n    const origin = `${protocol}//${host}`\n    return this._authorizedOrigins.includes(origin)\n  }\n\n  shouldAuthenticateRequest({ url, options = {} }) {\n    const originViolation = !this.isAllowedOrigin(url)\n\n    const strictSslCheckViolation =\n      this._requireStrictSslToAuthenticate &&\n      this.constructor._isInsecureSslRequest({ options })\n\n    return this.isConfigured && !originViolation && !strictSslCheckViolation\n  }\n\n  get _basicAuth() {","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/badges/shields/blob/766fd8bc89a90b8534dc573ab72dec30215ab1ec/core/base-service/auth-helper.js#L85-L121","documentation":"isAllowedOrigin parses the given URL with `new URL(url)`; if the URL is malformed and the constructor throws, the helper wraps it as InvalidParameter with prettyMessage 'invalid url parameter'. It is used by _getJwt (via originViolation) to authorize the JWT login endpoint against `_authorizedOrigins`, so a bad URL can never be compared against the allowlist.","triggerScenarios":"Passing a non-URL string (empty string, 'selfhosted/api', 'localhost:8080/login' without scheme, URL with spaces) as the loginEndpoint/auth URL into code that reaches isAllowedOrigin — e.g. `token` on a JWT-auth helper with a misconfigured `authUrl`/config value.","commonSituations":"Typos or missing scheme (https://) in service config for JWT/token-based auth; environment variables or user config supplying a partial URL; template strings that resolve to empty because an upstream config key was missing.","solutions":["Ensure the URL includes a valid scheme, e.g. https://host/path (use `new URL(candidate)` locally to validate first)","Check the config/env value feeding the URL — a missing variable often yields '' or 'undefined'","URL-encode spaces and illegal characters, or trim whitespace from the value","Validate user-supplied config at load time and reject it early with a clear message"],"exampleFix":"// before\nconst loginEndpoint = config.jiraServer + '/rest/oauth-token' // if config.jiraServer is undefined -> 'undefined/rest/...'\n// after\nif (!config.jiraServer) throw new Error('jiraServer config is required')\nconst loginEndpoint = `https://${new URL(config.jiraServer).host}/rest/oauth-token`","handlingStrategy":"validation","validationCode":"function assertValidUrl(candidate) {\n  let u\n  try { u = new URL(candidate) } catch { throw new Error(`invalid url parameter: ${JSON.stringify(candidate)}`) }\n  if (!['http:', 'https:'].includes(u.protocol)) throw new Error('url must be http(s)')\n  return u\n}\nassertValidUrl(loginEndpoint)","typeGuard":"function isHttpUrl(value) {\n  if (typeof value !== 'string' || value.length === 0) return false\n  try { const u = new URL(value); return u.protocol === 'http:' || u.protocol === 'https:' } catch { return false }\n}\nif (isHttpUrl(loginEndpoint)) { /* proceed */ }","tryCatchPattern":"try {\n  const token = await service.token({ loginEndpoint })\n} catch (err) {\n  if (err.prettyMessage === 'invalid url parameter') {\n    // log the offending config value and fail fast with a config-fix hint\n  } else throw err\n}","preventionTips":["Validate URL config at startup, before any requests are made","Always include the scheme (https://) in configured base URLs","Trim and URL-encode user-supplied values","Guard against undefined template parts: `new URL(`${base}${path}`)` throws loudly if base is empty"],"tags":["url","config","invalid-parameter","auth"],"backgroundTag":"invalid-url-parameter","analyzedSha":"766fd8bc89a90b8534dc573ab72dec30215ab1ec","analyzedAt":"2026-08-30T01:40:27.499Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}