{"record":{"id":"925c718496c5a617","repo":"zeroclaw-labs/zeroclaw","slug":"url-userinfo-is-not-allowed-925c71","errorCode":null,"errorMessage":"URL userinfo is not allowed","messagePattern":"URL userinfo is not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/web_fetch.rs","lineNumber":811,"sourceCode":"                .with_attrs(::serde_json::json!({\"url\": url, \"error\": format!(\"{e}\")})),\n            \"web_fetch: invalid URL\"\n        );\n        anyhow::Error::msg(format!(\"Invalid URL format: {e}\"))\n    })?;\n\n    if !matches!(parsed.scheme(), \"http\" | \"https\") {\n        ::zeroclaw_log::record!(\n            WARN,\n            ::zeroclaw_log::Event::new(module_path!(), ::zeroclaw_log::Action::Reject)\n                .with_outcome(::zeroclaw_log::EventOutcome::Failure)\n                .with_attrs(::serde_json::json!({\"url\": url})),\n            \"web_fetch: non-http(s) URL rejected\"\n        );\n        anyhow::bail!(\"Only http:// and https:// URLs are allowed\");\n    }\n\n    if !parsed.username().is_empty() || parsed.password().is_some() {\n        anyhow::bail!(\"URL userinfo is not allowed\");\n    }\n\n    let host = parsed\n        .host_str()\n        .ok_or_else(|| anyhow::Error::msg(\"URL must include a host\"))?;\n    // `Url::host_str()` serializes IPv6 literals with brackets, so parsing the\n    // returned string directly would never recognize them.\n    if host.starts_with('[') {\n        anyhow::bail!(\"IPv6 hosts are not supported in web_fetch\");\n    }\n\n    let host = host.trim_end_matches('.').to_ascii_lowercase();\n\n    if host.is_empty() {\n        anyhow::bail!(\"URL must include a valid host\");\n    }\n\n    Ok(host)","sourceCodeStart":793,"sourceCodeEnd":829,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/web_fetch.rs#L793-L829","documentation":"Error \"URL userinfo is not allowed\" thrown in zeroclaw-labs/zeroclaw.","triggerScenarios":"Thrown at crates/zeroclaw-tools/src/web_fetch.rs:811 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the `user:password@` userinfo segment from the URL and pass credentials via headers or configuration instead.","Use a URL of the form https://host/path without embedded credentials."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}