{"record":{"id":"70379834afd60ede","repo":"roboflow/supervision","slug":"url-authority-contains-a-backslash","errorCode":null,"errorMessage":"URL authority contains a backslash","messagePattern":"URL authority contains a backslash","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"src/supervision/utils/file.py","lineNumber":32,"sourceCode":"\n\ndef _normalize_http_url(url: str) -> str:\n    \"\"\"\n    Validate and normalize an HTTP(S) URL.\n\n    Args:\n        url: URL to validate.\n\n    Returns:\n        Normalized URL string.\n\n    Raises:\n        ValueError: If the URL is invalid or uses an unsupported scheme.\n    \"\"\"\n    try:\n        original_parsed_url = urllib.parse.urlparse(url)\n        if \"\\\\\" in original_parsed_url.netloc:\n            raise ValueError(\"URL authority contains a backslash\")\n\n        prepared_request = requests.Request(method=\"GET\", url=url).prepare()\n        prepared_url = prepared_request.url\n        if prepared_url is None:\n            raise ValueError(\"prepared URL is empty\")\n\n        parsed_url = urllib.parse.urlparse(prepared_url)\n    except (requests.RequestException, ValueError) as error:\n        raise ValueError(f\"Invalid URL {url!r}: {error}\") from error\n\n    if parsed_url.scheme not in {\"http\", \"https\"}:\n        raise ValueError(\n            f\"Unsupported URL scheme {parsed_url.scheme!r} in {url!r}. \"\n            \"Only HTTP and HTTPS URLs are supported.\"\n        )\n    if parsed_url.hostname is None:\n        raise ValueError(f\"Invalid URL {url!r}: no host supplied.\")\n","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/roboflow/supervision/blob/7f254d9784d4c37e0f03cd89ddee164c8db099c0/src/supervision/utils/file.py#L14-L50","documentation":"Raised during URL validation when the netloc (authority) of the URL contains a backslash. Backslashes in the authority are a classic SSRF/parser-confusion vector (browsers and server-side parsers can disagree about where the host ends), so supervision rejects them outright before letting `requests` normalize the URL.","triggerScenarios":"Passing a Windows path with forward scheme: `'http:\\\\server\\share\\file'`; mixed-separator URLs like 'https://host\\path'; malicious input where `\\` attempts to smuggle a different origin past the validator.","commonSituations":"Users pasting Windows UNC/network paths into a URL field; scripts building URLs from `os.path.join` on Windows; security testing payloads.","solutions":["Use proper URL syntax: forward slashes and a normal host ('https://host/path').","Convert Windows paths with `pathlib.PureWindowsPath(...).as_posix()` before embedding, and never in the authority.","For local files, use the local-path API rather than a URL."],"exampleFix":"# before\nurl = 'http:\\\\server\\share\\image.jpg'\n# after\nurl = 'https://server/share/image.jpg'","handlingStrategy":"validation","validationCode":"from urllib.parse import urlparse\nassert '\\\\' not in urlparse(url).netloc, 'backslash in URL authority'","typeGuard":"def url_authority_clean(url: str) -> bool:\n    return '\\\\' not in urlparse(url).netloc","tryCatchPattern":null,"preventionTips":["Never paste Windows paths into URL fields; use the local-file API.","Build URL path parts with forward slashes only.","Convert Windows paths with pathlib before embedding anywhere."],"tags":["url","security","ssrf","validation","windows"],"backgroundTag":null,"analyzedSha":"7f254d9784d4c37e0f03cd89ddee164c8db099c0","analyzedAt":"2026-08-15T05:13:01.950Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}