{"record":{"id":"d16d709f844ddff2","repo":"docker/cli","slug":"invalid-proto-expected-s-s","errorCode":null,"errorMessage":"invalid proto, expected %s: %s","messagePattern":"invalid proto, expected (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"opts/hosts.go","lineNumber":86,"sourceCode":"\tcase \"npipe\":\n\t\treturn parseSimpleProtoAddr(proto, host, defaultNamedPipe)\n\tcase \"fd\":\n\t\treturn addr, nil\n\tcase \"ssh\":\n\t\treturn addr, nil\n\tdefault:\n\t\treturn \"\", fmt.Errorf(\"invalid bind address format: %s\", addr)\n\t}\n}\n\n// parseSimpleProtoAddr parses and validates that the specified address is a valid\n// socket address for simple protocols like unix and npipe. It returns a formatted\n// socket address, either using the address parsed from addr, or the contents of\n// defaultAddr if addr is a blank string.\nfunc parseSimpleProtoAddr(proto, addr, defaultAddr string) (string, error) {\n\taddr = strings.TrimPrefix(addr, proto+\"://\")\n\tif strings.Contains(addr, \"://\") {\n\t\treturn \"\", fmt.Errorf(\"invalid proto, expected %s: %s\", proto, addr)\n\t}\n\tif addr == \"\" {\n\t\taddr = defaultAddr\n\t}\n\treturn fmt.Sprintf(\"%s://%s\", proto, addr), nil\n}\n\n// ParseTCPAddr parses and validates that the specified address is a valid TCP\n// address. It returns a formatted TCP address, either using the address parsed\n// from tryAddr, or the contents of defaultAddr if tryAddr is a blank string.\n// tryAddr is expected to have already been Trim()'d\n// defaultAddr must be in the full `tcp://host:port` form\nfunc ParseTCPAddr(tryAddr string, defaultAddr string) (string, error) {\n\tif tryAddr == \"\" || tryAddr == \"tcp://\" {\n\t\treturn defaultAddr, nil\n\t}\n\taddr := strings.TrimPrefix(tryAddr, \"tcp://\")\n\tif strings.Contains(addr, \"://\") || addr == \"\" {","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/opts/hosts.go#L68-L104","documentation":"parseSimpleProtoAddr handles unix and npipe addresses. After stripping the expected proto:// prefix it rejects any value that still contains '://', i.e. a nested or repeated scheme such as unix://tcp://x. The address must be a plain socket path for the given proto.","triggerScenarios":"-H with a doubled or nested scheme for unix/npipe, e.g. -H unix://tcp://x, -H npipe://foo://bar, or otherwise embedding '://' inside a unix/npipe address.","commonSituations":"Chaining schemes by mistake; malformed socket path containing a colon-slash sequence; copy-paste mixing two -H examples.","solutions":["Provide a single scheme: unix:///var/run/docker.sock or unix://path.","Remove any nested '://' from the socket path.","For Windows named pipes use npipe://./pipe/docker_engine.","Validate that the address contains at most one '://' before calling parseSimpleProtoAddr."],"exampleFix":"# before\ndocker -H unix://tcp://x ps\n\n# after\ndocker -H unix:///var/run/docker.sock ps","handlingStrategy":"validation","validationCode":"// Reject nested schemes for unix/npipe addresses.\nfunc noNestedScheme(addr string) error {\n    if strings.Count(addr, \"://\") > 1 {\n        return fmt.Errorf(\"nested scheme in %q\", addr)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provide a single scheme per -H value.","For unix sockets use unix:///path or unix://path only.","Validate that the address contains at most one '://'."],"tags":["docker","daemon","host","parsing","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}