{"record":{"id":"c78ea7bb809dc9cc","repo":"oven-sh/bun","slug":"invalidurlfield","errorCode":null,"errorMessage":"InvalidUrlField","messagePattern":"InvalidUrlField","errorType":"exception","errorClass":"bun_install::Error","httpStatus":null,"severity":"error","filePath":"src/install/error.rs","lineNumber":137,"sourceCode":"    #[error(\"MissingAdvisoriesField\")]\n    MissingAdvisoriesField,\n    #[error(\"SecurityScannerFailed\")]\n    SecurityScannerFailed,\n    #[error(\"SecurityScannerTerminated\")]\n    SecurityScannerTerminated,\n    #[error(\"InvalidAdvisoriesFormat\")]\n    InvalidAdvisoriesFormat,\n    #[error(\"InvalidAdvisoryFormat\")]\n    InvalidAdvisoryFormat,\n    #[error(\"MissingPackageField\")]\n    MissingPackageField,\n    #[error(\"InvalidPackageField\")]\n    InvalidPackageField,\n    #[error(\"EmptyPackageField\")]\n    EmptyPackageField,\n    #[error(\"InvalidDescriptionField\")]\n    InvalidDescriptionField,\n    #[error(\"InvalidUrlField\")]\n    InvalidUrlField,\n    #[error(\"MissingLevelField\")]\n    MissingLevelField,\n    #[error(\"InvalidLevelField\")]\n    InvalidLevelField,\n    #[error(\"InvalidLevelValue\")]\n    InvalidLevelValue,\n    #[error(\"Missing global bin directory: try setting $BUN_INSTALL\")]\n    MissingGlobalBinDirectoryTrySettingBUNINSTALL,\n    #[error(\"InvalidURL\")]\n    InvalidURL,\n    #[error(\"Fail\")]\n    Fail,\n    #[error(\"IntegrityCheckFailed\")]\n    IntegrityCheckFailed,\n    #[error(\"RepositoryNotFound\")]\n    RepositoryNotFound,\n    #[error(\"DebugTextLockfileRoundTrip\")]","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L119-L155","documentation":"The advisory's optional `url` field, when present, must be a string or null (security_scanner.rs:1867-1879). Objects or other types are rejected with the index printed. Like description, the field may be omitted entirely.","triggerScenarios":"Scanner sends a parsed URL object (\"url\": {\"href\": ..., \"protocol\": \"https:\"}) or an array of reference links in the url slot.","commonSituations":"Serializing a WHATWG/Node URL object without .href; multiple references squashed into an array; advisory records reused from tools with structured links.","solutions":["Send the link as a plain string: \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-...\"","Use .href (or String(url)) when you hold a URL object","If several links exist, pick the primary one and put the rest in description, or send null"],"exampleFix":"// before\nadvisories: [{ package: \"foo\", level: \"warn\", url: new URL(\"https://example.com/advisory\") }]\n\n// after\nadvisories: [{ package: \"foo\", level: \"warn\", url: \"https://example.com/advisory\" }]","handlingStrategy":"type-guard","validationCode":"// scanner-side: always send url as a string\nfor (const a of advisories) if (a.url != null && typeof a.url !== \"string\") a.url = a.url.href ?? String(a.url);","typeGuard":"const validAdvisoryUrl = (u) => u == null || typeof u === \"string\";","tryCatchPattern":null,"preventionTips":["Use url.href for URL objects before serialization","Pick one canonical link per advisory; extras belong in description","Omit or null the field when no reference exists"],"tags":["security-scanner","json","schema","url"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}