{"record":{"id":"c17bde12232e8736","repo":"can1357/oh-my-pi","slug":"remote-url-must-not-start-with","errorCode":null,"errorMessage":"remote url must not start with '-'","messagePattern":"remote url must not start with '-'","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"python/robomp/src/proxy/server.py","lineNumber":346,"sourceCode":"        raise HTTPException(400, f\"remote url host must be github.com for repo {expected_repo!r}\")\n    if parsed.params or parsed.query or parsed.fragment:\n        raise HTTPException(400, \"remote url must not contain params, query, or fragment\")\n    path = parsed.path.strip(\"/\")\n    if path.endswith(\".git\"):\n        path = path[:-4]\n    if path.lower() != expected_repo.lower():\n        raise HTTPException(400, f\"remote url does not match repo {expected_repo!r}\")\n    return _github_url_for_repo(expected_repo)\n\n\ndef _remote_auth_for_url(url: str, expected_repo: str, token: str) -> _RemoteAuth:\n    raw = url.strip()\n    if not raw or raw != url:\n        raise HTTPException(400, \"remote url must not be empty or padded\")\n    if _FORBIDDEN_URL_BYTES_RE.search(raw):\n        raise HTTPException(400, \"remote url contains forbidden control bytes\")\n    if raw.startswith(\"-\"):\n        raise HTTPException(400, \"remote url must not start with '-'\")\n    if _REMOTE_HELPER_RE.match(raw):\n        raise HTTPException(400, \"git remote helper transports are disabled\")\n    scheme = (urlparse(raw).scheme or \"\").lower()\n    if scheme in (\"http\", \"https\"):\n        normalized = _normalized_github_https_url(raw, expected_repo)\n        return _RemoteAuth(url=normalized, token=token, auth_url=normalized)\n    return _RemoteAuth(url=raw, token=None, auth_url=None)\n\n\ndef _clone_remote_auth(clone_url: str, expected_repo: str, token: str) -> _RemoteAuth:\n    try:\n        return _remote_auth_for_url(clone_url, expected_repo, token)\n    except HTTPException:\n        log.warning(\n            \"gh-proxy: refusing clone — clone_url is not permitted\",\n            extra={\"expected_repo\": expected_repo},\n        )\n        raise","sourceCodeStart":328,"sourceCodeEnd":364,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/python/robomp/src/proxy/server.py#L328-L364","documentation":"A remote URL beginning with '-' is rejected with HTTP 400. Leading dashes make the value look like a command-line option to git (option/argument confusion), so the proxy refuses any URL whose first character is '-' before it is ever passed to a git command.","triggerScenarios":"Passing a value like '--upload-pack=evil' or '-foo' as the remote/repo URL to an endpoint that resolves to _clone_remote_auth or _origin_remote_auth.","commonSituations":"Malicious input probing git option injection; accidental paste of a flag into a URL field; templating bugs where a flag variable is substituted into the URL slot.","solutions":["Ensure the value is a real URL (scheme://...) not a git flag","Strip or reject leading-dash input at the caller before calling the proxy","If using untrusted input, validate the URL starts with an allowed scheme like https://"],"exampleFix":"// before\nconst target = \"--upload-pack=evil\";\n// after\nif (!/^https?:\\/\\//.test(target)) throw new Error(\"expected URL, got: \" + target);","handlingStrategy":"validation","validationCode":"if (url.startsWith(\"-\")) throw new Error(\"remote url must not start with '-'\");","typeGuard":"function isUrlLike(u: unknown): u is string {\n  return typeof u === \"string\" && /^[A-Za-z][A-Za-z0-9+.-]*:\\/\\//.test(u);\n}","tryCatchPattern":null,"preventionTips":["Validate URLs start with an explicit scheme (https://, ssh://)","Keep flag arguments and URL values in separate variables/fields","Treat all remote URL fields as git-argument-sensitive input"],"tags":["http-400","security","git-injection"],"backgroundTag":"url-validation-rejected","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}