{"record":{"id":"b0b727b79e2a1bac","repo":"JuliusBrussee/caveman","slug":"provider-q-upstream-url-path-rejected-w","errorCode":null,"errorMessage":"provider %q upstream URL path rejected: %w","messagePattern":"provider %q upstream URL path rejected: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/providers/openaicompat/openaicompat.go","lineNumber":394,"sourceCode":"\t}\n\tu, err := url.Parse(strings.TrimSpace(raw))\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif u.Scheme != \"http\" && u.Scheme != \"https\" {\n\t\treturn nil, fmt.Errorf(\"provider %q upstream URL scheme %q is not allowed\", provider, u.Scheme)\n\t}\n\tif !u.IsAbs() || u.Host == \"\" || u.Hostname() == \"\" {\n\t\treturn nil, fmt.Errorf(\"provider %q upstream URL must be an absolute URL with a host\", provider)\n\t}\n\tif u.User != nil {\n\t\treturn nil, fmt.Errorf(\"provider %q upstream URL must not include userinfo\", provider)\n\t}\n\tif u.Fragment != \"\" {\n\t\treturn nil, fmt.Errorf(\"provider %q upstream URL must not include a fragment\", provider)\n\t}\n\tif err := validatePathComponents(u.Path, u.RawPath); err != nil {\n\t\treturn nil, fmt.Errorf(\"provider %q upstream URL path rejected: %w\", provider, err)\n\t}\n\treturn u, nil\n}\n","sourceCodeStart":376,"sourceCodeEnd":398,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/15581d14007fd01fb3f132016741962f34936ca2/proxy/providers/openaicompat/openaicompat.go#L376-L398","documentation":"The path portion of the named provider's upstream URL failed the shared path-component hardening (backslash, empty interior segment, dot segment, or ambiguous %2f/%5c/%2e escape). The wrapped error names the exact violation; this guards against route-identity changes across proxy hops.","triggerScenarios":"Thrown at proxy/providers/openaicompat/openaicompat.go:314 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove backslashes, double slashes, and . / .. segments from the configured base_url path","Percent-encode legitimate special characters instead of leaving raw %2f, %5c, or %2e sequences in the path","Simplify the base_url to host plus optional clean path prefix, moving route logic to config fields"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"15581d14007fd01fb3f132016741962f34936ca2","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}