{"record":{"id":"aaeedfb784f09444","repo":"jdx/mise","slug":"ref-must-not-start-with","errorCode":null,"errorMessage":"`ref` must not start with `-`","messagePattern":"`ref` must not start with `-`","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/repos.rs","lineNumber":135,"sourceCode":"                if let Component::Normal(segment) = component {\n                    resolved.push(segment);\n                }\n            }\n            resolved\n        };\n        let Some(url) = config.url.map(|s| s.trim().to_string()) else {\n            bail!(\"must set `url`\");\n        };\n        if url.is_empty() {\n            bail!(\"must set a non-empty `url`\");\n        }\n        if url.starts_with('-') {\n            bail!(\"`url` must not start with `-`\");\n        }\n        let git_ref = config.git_ref.map(|s| s.trim().to_string());\n        let git_ref = match git_ref {\n            Some(git_ref) if git_ref.is_empty() => bail!(\"`ref` must not be empty\"),\n            Some(git_ref) if git_ref.starts_with('-') => bail!(\"`ref` must not start with `-`\"),\n            other => other,\n        };\n        Ok(Self {\n            path_raw,\n            path,\n            url,\n            git_ref,\n        })\n    }\n}\n\nimpl std::fmt::Display for RepoRequest {\n    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {\n        write!(f, \"{}\", file::display_path(&self.path))\n    }\n}\n\npub(crate) async fn status(requests: &[RepoRequest]) -> Result<Vec<RepoStatus>> {","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/repos.rs#L117-L153","documentation":"Like url, an explicit `ref` must not begin with `-`: git would parse it as an option instead of a revision (argument-injection risk). from_toml validates this after trimming, before any git command is built.","triggerScenarios":"Setting `ref = \"--depth=1\"` or any value starting with `-` in a `[bootstrap.repos]` entry.","commonSituations":"Confusing git CLI flags with ref names; trying to pass extra fetch options via ref; copy/paste that picked up a leading dash.","solutions":["Use an actual branch, tag, or SHA for `ref` (e.g. `ref = \"v1.2.0\"`)","Move any desired git options out of the config into git config or the invoking environment","Remove stray leading whitespace/dash characters from the ref value"],"exampleFix":"// before\n\"~/src/dotfiles\" = { url = \"https://github.com/jdx/dotfiles.git\", ref = \"--depth=1\" }\n// after\n\"~/src/dotfiles\" = { url = \"https://github.com/jdx/dotfiles.git\", ref = \"main\" }","handlingStrategy":"validation","validationCode":"function validateRefSafe(entry) {\n  if ('ref' in entry && entry.ref.trim().startsWith('-')) {\n    throw new Error('ref must not start with -');\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use only branch names, tags, or SHAs in `ref`","Never place git flags in `ref`; they are rejected by design","Validate refs with `git rev-parse --verify <ref>` before committing them to config"],"tags":["config","security","git","argument-injection"],"backgroundTag":"invalid-argument-value","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}