{"record":{"id":"7002b492bd214b80","repo":"jdx/mise","slug":"url-must-not-start-with","errorCode":null,"errorMessage":"`url` must not start with `-`","messagePattern":"`url` must not start with `-`","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/repos.rs","lineNumber":130,"sourceCode":"            // Join only the Normal segments so `./foobar` resolves to\n            // `<root>/foobar` rather than `<root>/./foobar` — a `.` component\n            // survives `Path::join` and leaks into every displayed path.\n            let mut resolved = root.to_path_buf();\n            for component in path.components() {\n                if let Component::Normal(segment) = component {\n                    resolved.push(segment);\n                }\n            }\n            resolved\n        };\n        let Some(url) = config.url.map(|s| s.trim().to_string()) else {\n            bail!(\"must set `url`\");\n        };\n        if url.is_empty() {\n            bail!(\"must set a non-empty `url`\");\n        }\n        if url.starts_with('-') {\n            bail!(\"`url` must not start with `-`\");\n        }\n        let git_ref = config.git_ref.map(|s| s.trim().to_string());\n        let git_ref = match git_ref {\n            Some(git_ref) if git_ref.is_empty() => bail!(\"`ref` must not be empty\"),\n            Some(git_ref) if git_ref.starts_with('-') => bail!(\"`ref` must not start with `-`\"),\n            other => other,\n        };\n        Ok(Self {\n            path_raw,\n            path,\n            url,\n            git_ref,\n        })\n    }\n}\n\nimpl std::fmt::Display for RepoRequest {\n    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/repos.rs#L112-L148","documentation":"A url beginning with `-` would be interpreted by git as a command-line option rather than a repository argument (argument-injection risk), so from_toml rejects it before constructing any git command. URLs must start with a real remote designator like `https://`, `git@`, `ssh://`, or a filesystem path.","triggerScenarios":"Setting `url = \"--upload-pack=...\"` or any value whose first character after trimming is `-` in a `[bootstrap.repos]` entry.","commonSituations":"Mistakenly pasting git CLI flags into the url field; attempting to smuggle extra git options through the config (blocked by design); stray dash from a broken copy/paste.","solutions":["Remove the leading `-` and supply a proper git remote URL","Put intended git options in the correct git configuration or command context, not in `url`","Prefix file-based remotes with `file://` or an absolute path instead of dash-like shorthand"],"exampleFix":"// before\n\"~/src/dotfiles\" = { url = \"--depth=1 https://github.com/jdx/dotfiles.git\" }\n// after\n\"~/src/dotfiles\" = { url = \"https://github.com/jdx/dotfiles.git\" }","handlingStrategy":"validation","validationCode":"function validateUrlSafe(entry) {\n  const url = entry.url.trim();\n  if (url.startsWith('-')) throw new Error('url must not start with -');\n  if (!/^(https?:\\/\\/|ssh:\\/\\/|git@|[\\w.~-]+@)/.test(url)) throw new Error('url is not a git remote');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat `url` as a git remote only — never embed CLI flags","Audit repo entries for values starting with `-`","Prefer canonical https/ssh URL forms"],"tags":["config","security","git","argument-injection"],"backgroundTag":"invalid-argument-value","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}