{"record":{"id":"b1a02d4c0cadcfeb","repo":"epi052/feroxbuster","slug":"url-to-parse-doesn-t-have-a-host","errorCode":null,"errorMessage":"url to parse doesn't have a host","messagePattern":"url to parse doesn't have a host","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/utils.rs","lineNumber":643,"sourceCode":"/// In the instance of a url with encoded path traversal strings, such as\n/// /path/%2e%2e/file.html, the underlying `url::Url::parse` will\n/// further encode the %-signs and return /path/%252e%252e/file.html\npub fn parse_url_with_raw_path(url: &str) -> Result<Url> {\n    log::trace!(\"enter: parse_url_with_raw_path({url})\");\n\n    let parsed = Url::parse(url)?;\n\n    if !parsed.has_authority() {\n        // parsed correctly, but no authority, meaning mailto: or tel: or\n        // some other url that we don't care about\n        bail!(\"url to parse has no authority and is therefore invalid\");\n    }\n\n    // thanks to @devx00: the possibility exists for Url to return true for\n    // has_authority, but not have a host/port, so we'll check for that\n    // and bail if it's the case\n    if parsed.host().is_none() {\n        bail!(\"url to parse doesn't have a host\");\n    }\n\n    // we have a valid url, the next step is to check the path and see if it's\n    // something that url::Url::parse would silently transform\n    //\n    // i.e. if the path is /path/../file.html, url::Url::parse will transform it\n    // to /file.html, which is not what we want\n\n    let farthest_right_authority_part;\n\n    // we want to find the farthest right authority component, which is the\n    // component that is the furthest right in the url that is part of the\n    // authority\n    //\n    // per RFC 3986, the authority is defined as:\n    // - authority = [ userinfo \"@\" ] host [ \":\" port ]\n    //\n    // so the farthest right authority component is either the port or the host","sourceCodeStart":625,"sourceCodeEnd":661,"githubUrl":"https://github.com/epi052/feroxbuster/blob/1f595dab5c76858d5a14fbc47dabf2563d729c62/src/utils.rs#L625-L661","documentation":"parse_url_with_raw_path validates a URL string before handing it to url::Url parsing. Because url::Url can report has_authority while still returning no host (e.g. bare scheme-like inputs), this check bails when parsed.host() is None to avoid later logic assuming a host/port exists.","triggerScenarios":"Passing a string that parses as an absolute URL with an authority component but no resolvable host, such as 'http://' or 'http:///path', into parse_url_with_raw_path — directly or via check_for_updates, parse_url_with_no_base_correction, parse_cli_args, parse_request_file, ordered_scan_url, or parse_url_and_add_subpaths.","commonSituations":"A raw request file whose first line is malformed ('http:///foo'), a mistyped --url CLI argument, or scan targets read from a wordlist/file containing scheme-only entries like 'http://'.","solutions":["Fix the input URL to include a host, e.g. 'http://localhost' instead of 'http://'","Pre-validate with a regex or Url::parse and check url.host().is_some() before calling","Strip or skip empty/malformed entries when reading targets from files or wordlists"],"exampleFix":"// before\nparse_url_with_raw_path(\"http://\")?;\n// after\nparse_url_with_raw_path(\"http://localhost:8000\")?;","handlingStrategy":"validation","validationCode":"fn has_host(u: &str) -> bool { url::Url::parse(u).map(|p| p.host().is_some()).unwrap_or(false) }\nif !has_host(candidate) { skip_or_report(candidate); }","typeGuard":"fn is_parseable_url(s: &str) -> Option<url::Url> { url::Url::parse(s).ok().filter(|u| u.host().is_some()) }","tryCatchPattern":"match parse_url_with_raw_path(input) { Ok(u) => scan(u), Err(e) if e.to_string().contains(\"doesn't have a host\") => warn_and_skip(input), Err(e) => return Err(e) }","preventionTips":["Always include scheme://host in target URLs","Validate URLs with Url::parse + host().is_some() before use","Sanitize wordlists/file-based target lists for empty or scheme-only entries"],"tags":["url","parsing","validation"],"backgroundTag":"invalid-url-format","analyzedSha":"1f595dab5c76858d5a14fbc47dabf2563d729c62","analyzedAt":"2026-09-13T19:33:06.208Z","contentChangedAt":"2026-09-13T19:33:06.208Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}