{"record":{"id":"45d4397bbeefabef","repo":"JuliusBrussee/caveman","slug":"awssig-request-has-no-url","errorCode":null,"errorMessage":"awssig: request has no URL","messagePattern":"awssig: request has no URL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/awssig/awssig.go","lineNumber":73,"sourceCode":"// the Authorization, X-Amz-Date, X-Amz-Content-Sha256 (and, when present,\n// X-Amz-Security-Token) headers on req. The Host header is derived from req.URL.\n//\n// payloadHash is the lowercase hex SHA-256 of the request body; pass\n// HashPayload(body) for the common case, or UnsignedPayload() for streaming\n// bodies that must not be buffered. now fixes the signing instant (use\n// time.Now().UTC()); it is a parameter so tests are deterministic.\n//\n// Sign returns an error only for malformed inputs (no region/service, missing\n// credentials, unparseable URL). It never returns the secret in the error.\nfunc (s Signer) Sign(req *http.Request, creds Credentials, payloadHash string, now time.Time) error {\n\tif s.Region == \"\" || s.Service == \"\" {\n\t\treturn fmt.Errorf(\"awssig: signer requires region and service\")\n\t}\n\tif !creds.Valid() {\n\t\treturn fmt.Errorf(\"awssig: incomplete AWS credentials\")\n\t}\n\tif req.URL == nil {\n\t\treturn fmt.Errorf(\"awssig: request has no URL\")\n\t}\n\tnow = now.UTC()\n\tamzDate := now.Format(\"20060102T150405Z\")\n\tdateStamp := now.Format(\"20060102\")\n\n\thost := req.URL.Host\n\tif req.Host != \"\" {\n\t\thost = req.Host\n\t}\n\treq.Header.Set(\"Host\", host)\n\treq.Header.Set(\"X-Amz-Date\", amzDate)\n\treq.Header.Set(\"X-Amz-Content-Sha256\", payloadHash)\n\tif creds.SessionToken != \"\" {\n\t\treq.Header.Set(\"X-Amz-Security-Token\", creds.SessionToken)\n\t}\n\n\tcanonicalHeaders, signedHeaders := canonicalHeaderSet(req, host)\n\tcanonicalRequest := strings.Join([]string{","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/awssig/awssig.go#L55-L91","documentation":"Sign was given an http.Request with a nil URL, so there is no host, path, or query to build the SigV4 canonical request from. The caller constructed the request improperly (e.g. http.NewRequest failed and the error was ignored) — a precondition check before any cryptographic work.","triggerScenarios":"Thrown at shared/platform/awssig/awssig.go:73 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Build the request with a valid URL before passing it to Sign","Check and handle http.NewRequest errors instead of proceeding with a nil URL"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}