{"record":{"id":"6ccd40667d6ad35a","repo":"jdx/mise","slug":"git-remote-helpers-are-not-supported-for-remote-on","errorCode":null,"errorMessage":"Git remote helpers are not supported for remote onboarding","messagePattern":"Git remote helpers are not supported for remote onboarding","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/remote_repository.rs","lineNumber":57,"sourceCode":"    Ok(String::from_utf8(output.stdout)?\n        .trim_end_matches('\\n')\n        .to_string())\n}\n\npub(crate) fn validate_origin(origin: &str) -> Result<()> {\n    if origin.starts_with('-') || origin.chars().any(char::is_control) {\n        bail!(\"invalid repository origin\");\n    }\n    // Explicit local paths may contain colons; otherwise :: selects a Git helper.\n    let explicit_local = std::path::Path::new(origin).is_absolute()\n        || origin.starts_with(\"./\")\n        || origin.starts_with(\"../\");\n    if !explicit_local\n        && origin.split_once(\"::\").is_some_and(|(prefix, _)| {\n            !prefix.is_empty() && !prefix.contains(['/', '\\\\', '[', ']', '@', ':'])\n        })\n    {\n        bail!(\"Git remote helpers are not supported for remote onboarding\");\n    }\n    if !explicit_local && origin.contains(\"://\") {\n        let url = url::Url::parse(origin).wrap_err(\"invalid repository URL\")?;\n        if !matches!(url.scheme(), \"https\" | \"ssh\" | \"file\") {\n            bail!(\"remote bootstrap requires HTTPS, SSH, or a local path\");\n        }\n    }\n    if let Ok(url) = url::Url::parse(origin)\n        && (url.password().is_some()\n            || (url.scheme() != \"ssh\" && !url.username().is_empty())\n            || url.query().is_some()\n            || url.fragment().is_some())\n    {\n        bail!(\"repository origin must not contain credentials, query parameters, or fragments\");\n    }\n    Ok(())\n}\n","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/system/remote_repository.rs#L39-L75","documentation":"mise's remote onboarding only accepts HTTPS, SSH, or explicit local paths as repository origins. Git's 'remote helper' transport syntax (prefix::, e.g. ext:: or fork::) is blocked because spawning arbitrary helper programs would allow command execution during remote bootstrap. Origins that look like helper transports (a '::' whose prefix has no path/host characters) raise this error.","triggerScenarios":"Setting an origin like \"ext::sh -c echo pwned\" or \"helper::args\" in fetch/install_at where the prefix before '::' is non-empty and contains none of / \\ [ ] @ : and the origin is not an explicit local path.","commonSituations":"Copying git remote-helper URLs from specialized tooling docs; attempting to use ext::/ssh with custom commands through mise; misusing a helper-based transport for automation.","solutions":["Use a standard https:// or ssh:// (scp-like user@host:path) URL instead","For local repos, use an absolute path or one starting with ./ or ../","If a custom transport is genuinely needed, perform that clone outside mise remote onboarding and point mise at the resulting local path"],"exampleFix":"// before\norigin = \"ext::ssh -i key host repo\"\n// after\norigin = \"ssh://git@host/team/repo.git\"","handlingStrategy":"validation","validationCode":"const usesRemoteHelper = (o) => { if (typeof o !== 'string') return false; const i = o.indexOf('::'); if (i < 0) return false; const prefix = o.slice(0, i); return prefix.length > 0 && ![/[\\/\\\\]/, /[\\[\\]@:]/].some(rx => rx.test(prefix)); }; // reject origins where this returns true","typeGuard":"const isSupportedOrigin = (s) => { if (typeof s !== 'string') return false; if (/^(\\.\\.?\\/|\\/)/.test(s)) return true; if (s.includes('::')) return false; if (s.includes('://')) return /^https?:\\/\\//.test(s) || /^ssh:\\/\\//.test(s) || /^file:\\/\\//.test(s); return true; };","tryCatchPattern":"try { setOrigin(o); } catch (e) { console.error('Use https://, ssh://, or a local path; git remote helpers are blocked'); }","preventionTips":["Restrict origins to https://, ssh://, or local paths","Reject any '::' transport syntax in user-supplied origins at config load time","Educate users that helper transports are a remote-code-execution vector and intentionally unsupported"],"tags":["git","security","validation"],"backgroundTag":"invalid-url","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}