{"record":{"id":"650926a5d9dcf198","repo":"yamadashy/repomix","slug":"invalid-url-protocol-for-redacturl-url-url","errorCode":null,"errorMessage":"Invalid URL protocol for '${redactUrl(url)}'. URL must start with 'git@' or 'https://'","messagePattern":"Invalid URL protocol for '(.+?)'\\. URL must start with 'git@' or 'https://'","errorType":"validation","errorClass":"RepomixError","httpStatus":null,"severity":"error","filePath":"src/core/git/gitCommand.ts","lineNumber":238,"sourceCode":"    logger.trace('Failed to execute git log:', (error as Error).message);\n    throw error;\n  }\n};\n\n/**\n * Validates a Git URL for security and format\n * @throws {RepomixError} If the URL is invalid or contains potentially dangerous parameters\n */\nexport const validateGitUrl = (url: string): void => {\n  // Block dangerous git parameters that could be used for command injection\n  const dangerousParams = ['--upload-pack', '--receive-pack', '--config', '--exec'];\n  if (dangerousParams.some((param) => url.includes(param))) {\n    throw new RepomixError(`Invalid repository URL. URL contains potentially dangerous parameters: ${redactUrl(url)}`);\n  }\n\n  // Check if the URL starts with git@ or https://\n  if (!(url.startsWith('git@') || url.startsWith('https://'))) {\n    throw new RepomixError(`Invalid URL protocol for '${redactUrl(url)}'. URL must start with 'git@' or 'https://'`);\n  }\n\n  try {\n    if (url.startsWith('https://')) {\n      new URL(url);\n    }\n  } catch (error: unknown) {\n    logger.trace('Invalid repository URL:', redactErrorMessage(error));\n    throw new RepomixError(`Invalid repository URL. Please provide a valid URL: ${redactUrl(url)}`);\n  }\n};\n\n/**\n * Validates a Git ref (branch, tag, or commit) before passing it to git commands.\n * A ref starting with '-' could be interpreted as a git option (e.g. --upload-pack),\n * enabling argument injection. Git's own refname rules also forbid leading '-',\n * so rejecting it is safe for all legitimate branches, tags, and SHAs.\n * @throws {RepomixError} If the ref could be interpreted as a command-line option","sourceCodeStart":220,"sourceCodeEnd":256,"githubUrl":"https://github.com/yamadashy/repomix/blob/f465ad909315a22120636baf03fa5e28701a50cb/src/core/git/gitCommand.ts#L220-L256","documentation":"validateGitUrl only accepts URLs starting with 'git@' (SSH) or 'https://'. Any other protocol (http://, ssh://, file://, git://, plain paths) is rejected with this error to keep remote operations safe and predictable.","triggerScenarios":"Calling execLsRemote, execLsRemoteHead, or execGitShallowClone with a URL that does not begin with 'git@' or 'https://' — e.g. `http://github.com/owner/repo`, `ssh://git@...`, or a local path.","commonSituations":"Using old http:// links, org-hosted SSH URLs in ssh:// form, internal GitLab servers on http, or accidentally passing a local directory path to --remote.","solutions":["Switch the URL to https://, e.g. https://github.com/owner/repo.git.","Convert ssh:// URLs to the scp-like git@host:path form, e.g. git@github.com:owner/repo.git.","For http-only internal servers, use https if available or clone manually and run repomix on the local path.","Trim stray characters/whitespace before the URL so it truly starts with an accepted prefix."],"exampleFix":"// before\nrepomix --remote http://github.com/owner/repo\n\n// after\nrepomix --remote https://github.com/owner/repo","handlingStrategy":"validation","validationCode":"function assertRemoteUrlProtocol(url: string): void {\n  if (!(url.startsWith('git@') || url.startsWith('https://'))) {\n    throw new Error(`Unsupported URL protocol: ${url}. Use git@ or https:// form.`);\n  }\n}","typeGuard":"const isAcceptedGitUrl = (url: string): boolean =>\n  url.startsWith('git@') || url.startsWith('https://');","tryCatchPattern":"try {\n  await repomix.pack({ input: { remote: url } });\n} catch (e) {\n  if (e instanceof Error && e.message.includes(\"URL must start with 'git@' or 'https://'\")) {\n    console.error('Convert the URL: use https://... or git@host:path form.');\n  } else throw e;\n}","preventionTips":["Standardize on https:// URLs in scripts and CI variables.","Convert ssh://host/path URLs to git@host:path form.","Trim whitespace and stray prefixes before the URL.","For http-only internal hosts, clone manually and pack the local path instead."],"tags":["git","url-validation","remote"],"backgroundTag":"invalid-git-url","analyzedSha":"f465ad909315a22120636baf03fa5e28701a50cb","analyzedAt":"2026-08-29T01:27:42.024Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}