{"record":{"id":"7884265caa5092f4","repo":"yamadashy/repomix","slug":"invalid-repository-url-url-contains-potentially-d","errorCode":null,"errorMessage":"Invalid repository URL. URL contains potentially dangerous parameters: ${redactUrl(url)}","messagePattern":"Invalid repository URL\\. URL contains potentially dangerous parameters: (.+?)","errorType":"validation","errorClass":"RepomixError","httpStatus":null,"severity":"error","filePath":"src/core/git/gitCommand.ts","lineNumber":233,"sourceCode":"      maxCommits.toString(),\n    ]);\n\n    return result.stdout || '';\n  } catch (error) {\n    logger.trace('Failed to execute git log:', (error as Error).message);\n    throw error;\n  }\n};\n\n/**\n * Validates a Git URL for security and format\n * @throws {RepomixError} If the URL is invalid or contains potentially dangerous parameters\n */\nexport const validateGitUrl = (url: string): void => {\n  // Block dangerous git parameters that could be used for command injection\n  const dangerousParams = ['--upload-pack', '--receive-pack', '--config', '--exec'];\n  if (dangerousParams.some((param) => url.includes(param))) {\n    throw new RepomixError(`Invalid repository URL. URL contains potentially dangerous parameters: ${redactUrl(url)}`);\n  }\n\n  // Check if the URL starts with git@ or https://\n  if (!(url.startsWith('git@') || url.startsWith('https://'))) {\n    throw new RepomixError(`Invalid URL protocol for '${redactUrl(url)}'. URL must start with 'git@' or 'https://'`);\n  }\n\n  try {\n    if (url.startsWith('https://')) {\n      new URL(url);\n    }\n  } catch (error: unknown) {\n    logger.trace('Invalid repository URL:', redactErrorMessage(error));\n    throw new RepomixError(`Invalid repository URL. Please provide a valid URL: ${redactUrl(url)}`);\n  }\n};\n\n/**","sourceCodeStart":215,"sourceCodeEnd":251,"githubUrl":"https://github.com/yamadashy/repomix/blob/f465ad909315a22120636baf03fa5e28701a50cb/src/core/git/gitCommand.ts#L215-L251","documentation":"validateGitUrl blocks URLs containing git options that enable command/option injection (--upload-pack, --receive-pack, --config, --exec) before any git command runs. This is a security guard, so the URL is rejected outright and redacted in the message.","triggerScenarios":"Calling execLsRemote, execLsRemoteHead, or execGitShallowClone (e.g. via repomix --remote) with a repository URL whose string includes any of the dangerous parameters.","commonSituations":"Constructed URLs from untrusted input that accidentally embed query-like fragments, injection attempts against CI pipelines that pass user input as --remote targets, or copy-paste mistakes including extra git flags in the URL.","solutions":["Remove any git CLI flags embedded in the URL string; pass only the repository URL.","Sanitize/validate user-supplied URLs before passing them to repomix's remote APIs.","Use a plain https:// or git@ URL, e.g. https://github.com/owner/repo.git.","If extra git options are genuinely needed, perform them manually with git rather than through repomix."],"exampleFix":"// before\nawait cloneRepo('--upload-pack=my-script https://github.com/owner/repo')\n\n// after\nawait cloneRepo('https://github.com/owner/repo')","handlingStrategy":"validation","validationCode":"const dangerous = ['--upload-pack', '--receive-pack', '--config', '--exec'];\nfunction assertSafeRemoteUrl(url: string): void {\n  if (dangerous.some(p => url.includes(p))) {\n    throw new Error(`Refusing unsafe repository URL: ${url}`);\n  }\n}","typeGuard":"const isSafeGitUrl = (url: string): boolean =>\n  !['--upload-pack', '--receive-pack', '--config', '--exec'].some(p => url.includes(p));","tryCatchPattern":"try {\n  await repomix.pack({ input: { remote: url } });\n} catch (e) {\n  if (e instanceof Error && e.message.includes('potentially dangerous parameters')) {\n    console.error('Strip git CLI flags from the URL before passing it to --remote.');\n  } else throw e;\n}","preventionTips":["Never concatenate user input or git flags into repository URLs.","Sanitize untrusted remote inputs through a strict allowlist (host + owner/repo).","Pass only plain https:// or git@ URLs to --remote.","In CI, validate the remote URL parameter before invoking repomix."],"tags":["git","security","url-validation","command-injection"],"backgroundTag":"invalid-git-url","analyzedSha":"f465ad909315a22120636baf03fa5e28701a50cb","analyzedAt":"2026-08-29T01:27:42.024Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}