{"record":{"id":"563b2998550d95f6","repo":"crowdsecurity/crowdsec","slug":"unable-to-parse-url-s-s","errorCode":null,"errorMessage":"unable to parse url '%s': %s","messagePattern":"unable to parse url '(.+?)': (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/request.go","lineNumber":444,"sourceCode":"\n\ttransactionID := r.Header.Get(TransactionIDHeaderName)\n\tif transactionID == \"\" {\n\t\ttransactionID = uuid.New().String()\n\t}\n\n\tif httpVersion := r.Header.Get(HTTPVersionHeaderName); httpVersion != \"\" {\n\t\tapplyHTTPVersion(r, httpVersion, logger)\n\t} else {\n\t\tlogger.Debugf(\"missing '%s' header\", HTTPVersionHeaderName)\n\t}\n\n\tfor _, h := range forwardedHeaders {\n\t\tdelete(r.Header, h)\n\t}\n\n\tparsedURL, err := url.Parse(clientURI)\n\tif err != nil {\n\t\treturn ParsedRequest{}, fmt.Errorf(\"unable to parse url '%s': %s\", clientURI, err)\n\t}\n\n\toriginalHTTPRequest := r.Clone(r.Context())\n\toriginalHTTPRequest.Body = io.NopCloser(bytes.NewBuffer(body))\n\toriginalHTTPRequest.RemoteAddr = clientIP\n\toriginalHTTPRequest.RequestURI = clientURI\n\toriginalHTTPRequest.Method = clientMethod\n\toriginalHTTPRequest.Host = clientHost\n\toriginalHTTPRequest.URL = parsedURL\n\tif userAgent != \"\" {\n\t\t// Override the UA in the original request — this is what the WAF engine sees.\n\t\toriginalHTTPRequest.Header.Set(\"User-Agent\", userAgent)\n\t\tr.Header.Set(\"User-Agent\", userAgent)\n\t} else {\n\t\t// No forwarded UA: drop any UA the remediation layer added, on both copies.\n\t\toriginalHTTPRequest.Header.Del(\"User-Agent\")\n\t\tr.Header.Del(\"User-Agent\")\n\t}","sourceCodeStart":426,"sourceCodeEnd":462,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/request.go#L426-L462","documentation":"url.Parse rejected the reconstructed client URI (clientURI) while building a ParsedRequest for appsec evaluation. The URI came from the bouncer's forwarded request data, so this means the bouncer sent a malformed request line/URI that Go's URL parser refuses. Note the error uses %s, so it does not unwrap.","triggerScenarios":"Thrown at pkg/appsec/request.go:444 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the bouncer→appsec channel: the forwarded URL contains characters or structure Go rejects (bad percent-encoding, control chars)","Update the bouncer if a known forwarding bug exists","Isolate the offending request via appsec logs and reproduce it against the origin"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}