{"record":{"id":"49580c52e6132ba2","repo":"jdx/mise","slug":"invalid-http-setup-repository-url-use-a-git-crede","errorCode":null,"errorMessage":"invalid HTTP setup repository URL; use a Git credential helper for authentication","messagePattern":"invalid HTTP setup repository URL; use a Git credential helper for authentication","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/history/sync/network.rs","lineNumber":34,"sourceCode":"#[error(\"{0}\")]\npub(crate) struct NetworkError(pub String);\n\n/// Authentication belongs in a credential helper or SSH agent, never in\n/// persisted connection URLs or the errors recorded in history health.\npub(crate) fn validate_url(value: &str) -> Result<()> {\n    if value.trim().is_empty() || value.trim_start().starts_with('-') {\n        bail!(\"setup repository URL must be nonempty and must not start with '-'\");\n    }\n    let http_like = value\n        .trim_start()\n        .get(..5)\n        .is_some_and(|prefix| prefix.eq_ignore_ascii_case(\"http:\"))\n        || value\n            .trim_start()\n            .get(..6)\n            .is_some_and(|prefix| prefix.eq_ignore_ascii_case(\"https:\"));\n    if http_like && url::Url::parse(value).is_err() {\n        bail!(\"invalid HTTP setup repository URL; use a Git credential helper for authentication\");\n    }\n    if let Ok(url) = url::Url::parse(value) {\n        let http = matches!(url.scheme(), \"http\" | \"https\");\n        if url.password().is_some()\n            || (http\n                && (!url.username().is_empty()\n                    || url.query().is_some()\n                    || url.fragment().is_some()))\n        {\n            bail!(\n                \"setup repository URLs must not contain credentials, query parameters, or fragments; use a Git credential helper or SSH agent\"\n            );\n        }\n    }\n    Ok(())\n}\n\n#[cfg(test)]","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/history/sync/network.rs#L16-L52","documentation":"validate_url additionally parses HTTP/HTTPS remotes with the url crate. If a URL looks like an http(s) URL but fails strict URL parsing, the library rejects it rather than passing a malformed string to git — and the error explicitly points to credential helpers as the supported authentication route, so secrets never end up embedded in the URL.","triggerScenarios":"validate_url (invoked from fetch_with_depth, push, symbolic_head, ls_remote) receiving a string starting with http:/https: that url::Url::parse rejects — e.g. \"https://host repo.git\" (spaces), \"http:///path\" (missing host), unencoded special characters.","commonSituations":"Hand-edited remote URLs with typos or unescaped spaces; URLs assembled by string concatenation instead of a URL builder; missing scheme/host when templating; migrating a remote and dropping part of the URL.","solutions":["Fix the URL so it parses strictly as an absolute http(s) URL (scheme, host, path)","Percent-encode spaces and special characters, or shell-quote when assembling the URL","Use SSH form (git@host:path) if you don't want an HTTP remote; authenticate via a git credential helper, not the URL"],"exampleFix":"// before\nlet url = format!(\"https://{}:{}/org/repo.git\", user, token); // embedded creds / malformed\n// after\nlet url = \"https://host/org/repo.git\".to_string();\n// authenticate with: git config credential.helper ... or SSH agent","handlingStrategy":"validation","validationCode":"if (/^https?:/i.test(url)) {\n  new URL(url); // throws if malformed\n}","typeGuard":"function isParsableHttpUrl(v: string): boolean {\n  return /^https?:/i.test(v) && URL.canParse(v);\n}","tryCatchPattern":"if let Err(e) = validate_url(&value) {\n    if e.to_string().contains(\"invalid HTTP setup repository URL\") {\n        eprintln!(\"{e}; configure a credential helper instead of embedding auth in the URL\");\n    }\n    return Err(e);\n}","preventionTips":["Assemble URLs with a URL builder, never raw string concatenation","Validate remotes with the url crate (or equivalent) at config-load time, not at fetch time","Authenticate via git credential helpers; keep credentials out of URL strings entirely"],"tags":["git","url","validation"],"backgroundTag":"invalid-url","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}