{"record":{"id":"76a6c9d5d449e8f1","repo":"tauri-apps/tauri","slug":"invalid-url-pattern-for-remote-url-url-e","errorCode":null,"errorMessage":"invalid URL pattern for remote URL {url}: {e}","messagePattern":"invalid URL pattern for remote URL (.+?): (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tauri-utils/src/acl/resolved.rs","lineNumber":269,"sourceCode":"}\n\nfn resolve_command(\n  commands: &mut BTreeMap<String, Vec<ResolvedCommand>>,\n  command: String,\n  capability: &Capability,\n  scope_id: Option<ScopeKey>,\n  #[cfg(debug_assertions)] referenced_by_permission_identifier: &str,\n) -> Result<(), Error> {\n  let mut contexts = Vec::new();\n  if capability.local {\n    contexts.push(ExecutionContext::Local);\n  }\n  if let Some(remote) = &capability.remote {\n    contexts.extend(remote.urls.iter().map(|url| {\n      ExecutionContext::Remote {\n        url: url\n          .parse()\n          .unwrap_or_else(|e| panic!(\"invalid URL pattern for remote URL {url}: {e}\")),\n      }\n    }));\n  }\n\n  for context in contexts {\n    let resolved_list = commands.entry(command.clone()).or_default();\n\n    resolved_list.push(ResolvedCommand {\n      context,\n      #[cfg(debug_assertions)]\n      referenced_by: ResolvedCommandReference {\n        capability: capability.identifier.clone(),\n        permission: referenced_by_permission_identifier.to_owned(),\n      },\n      windows: parse_glob_patterns(capability.windows.clone())?,\n      webviews: parse_glob_patterns(capability.webviews.clone())?,\n      scope_id,\n    });","sourceCodeStart":251,"sourceCodeEnd":287,"githubUrl":"https://github.com/tauri-apps/tauri/blob/460ec35447493200d64290dd7f015d5a91d0fd58/crates/tauri-utils/src/acl/resolved.rs#L251-L287","documentation":"When resolving capabilities, remote URLs declared in a capability's `remote.urls` array are parsed into a `url::Url`. If any entry fails to parse (e.g. it is not a valid absolute URL), the library panics with this message during capability resolution at app startup. Tauri panics because an invalid remote URL makes the capability definition meaningless and there is no safe fallback.","triggerScenarios":"A capability TOML/JSON file contains `remote.urls = [\"...\"]` with a string that `url::Url::parse` rejects — missing scheme (\"localhost:5173\" instead of \"http://localhost:5173\"), typo'd scheme (\"http:/\"), or stray characters/whitespace.","commonSituations":"Hand-editing capability files and omitting the `http://` scheme; copying a host:port pair from a dev-server output; typos introduced while migrating config from tauri.conf.json to capability files.","solutions":["Fix the `remote.urls` entry in the offending capability file (under src-tauri/capabilities/) to be a full absolute URL including scheme, e.g. `https://example.com`.","Validate each URL by parsing it (e.g. `new URL(s)` / `url::Url::parse(s)`) before committing the capability file.","If the URL is intentionally wildcarded, remember `Url::parse` requires a scheme — use `https://*.example.com` style patterns, not bare domains."],"exampleFix":"// before (src-tauri/capabilities/main.json)\n\"remote\": { \"urls\": [\"localhost:1420\"] }\n// after\n\"remote\": { \"urls\": [\"http://localhost:1420\"] }","handlingStrategy":"validation","validationCode":"function isValidRemoteUrl(u) { try { const url = new URL(u); return url.protocol === 'http:' || url.protocol === 'https:'; } catch { return false; } }\n// check every remote.urls entry in src-tauri/capabilities/*.json before building","typeGuard":"const isCapabilityRemote = (c) => typeof c === 'object' && c !== null && Array.isArray(c.remote?.urls) && c.remote.urls.every(isValidRemoteUrl);","tryCatchPattern":null,"preventionTips":["Always include the scheme (http:// or https://) in remote.urls entries","Validate capability files in CI by parsing each remote URL with `new URL()` or `url::Url::parse`","Prefer the tauri CLI/schema validation over hand-editing capability JSON/TOML"],"tags":["config","url-parsing","capabilities","panic"],"backgroundTag":"invalid-url-format","analyzedSha":"460ec35447493200d64290dd7f015d5a91d0fd58","analyzedAt":"2026-09-18T23:55:51.277Z","contentChangedAt":"2026-09-18T23:55:51.277Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}