{"record":{"id":"d6c8c02e0121042a","repo":"projectdiscovery/nuclei","slug":"failed-to-parse-url-s","errorCode":null,"errorMessage":"failed to parse url: %s","messagePattern":"failed to parse url: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/input/types/http.go","lineNumber":258,"sourceCode":"\tmethod := parts[0]\n\trr.Request.Method = method\n\n\t// the request target is normally an origin-form path, but proxy captures and\n\t// .http files use the absolute form, which already carries the authority\n\tvar urlx *urlutil.URL\n\ttarget := parts[1]\n\tif stringsutil.HasPrefixAnyI(target, urlutil.HTTP+urlutil.SchemeSeparator, urlutil.HTTPS+urlutil.SchemeSeparator) {\n\t\t// urlutil.ParseAbsoluteURL only accepts lowercase schemes; preserve the\n\t\t// remainder of the request target unchanged.\n\t\tif scheme, rest, ok := strings.Cut(target, urlutil.SchemeSeparator); ok {\n\t\t\ttarget = strings.ToLower(scheme) + urlutil.SchemeSeparator + rest\n\t\t}\n\t\turlx, err = urlutil.ParseAbsoluteURL(target, true)\n\t} else {\n\t\turlx, err = urlutil.ParseRawRelativePath(target, true)\n\t}\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse url: %s\", err)\n\t}\n\trr.URL = *urlx\n\n\t// parse headers\n\trr.Request.Headers = mapsutil.NewOrderedMap[string, string]()\n\tfor {\n\t\tline, err := protoReader.ReadLine()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read header line: %s\", err)\n\t\t}\n\t\tif line == \"\" {\n\t\t\t// end of headers next is body\n\t\t\tbreak\n\t\t}\n\t\tkey, value, found := strings.Cut(line, \":\")\n\t\tif !found || key == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"invalid header line: %s\", line)\n\t\t}","sourceCodeStart":240,"sourceCodeEnd":276,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/input/types/http.go#L240-L276","documentation":"ParseRawRequest could not turn the request target (second token of the method line) into a URL. Absolute-form targets (http://.../https://...) go through urlutil.ParseAbsoluteURL with strict=true; origin-form targets go through urlutil.ParseRawRelativePath, which expects a path starting with '/' and valid path/query syntax.","triggerScenarios":"Relative target without a leading slash ('api/foo'), containing spaces or control chars, or '*'; absolute target with bad authority (e.g. 'http:///path', 'https://host:port:notaport/'). Mixed-case schemes like HTTP:// are handled by lowercasing, so that is not the cause.","commonSituations":"Pasting paths without the leading slash; unencoded spaces in query strings from manual edits; asterisk-form OPTIONS requests ('OPTIONS * HTTP/1.1') which this parser does not support; IPv6 literals missing brackets.","solutions":["Use an origin-form target starting with '/', e.g. '/api/v1/users?id=1', or a full absolute URL","Percent-encode spaces and unsafe characters in the path/query","Replace 'OPTIONS *' with 'OPTIONS / HTTP/1.1' (asterisk-form is unsupported)","Wrap IPv6 hosts in brackets: http://[::1]:8080/"],"exampleFix":"# before\nraw: |\n  GET api/users?id=1 HTTP/1.1\n\n# after\nraw: |\n  GET /api/users?id=1 HTTP/1.1","handlingStrategy":"validation","validationCode":"target := parts[1]\nif strings.HasPrefix(strings.ToLower(target), \"http://\") || strings.HasPrefix(strings.ToLower(target), \"https://\") {\n    if _, err := url.Parse(target); err != nil { return err }\n} else if !strings.HasPrefix(target, \"/\") {\n    return fmt.Errorf(\"origin-form target must start with '/': %q\", target)\n}","typeGuard":null,"tryCatchPattern":"Catch the parse failure, normalize the target (add leading '/', percent-encode spaces), and re-parse once before giving up on the entry.","preventionTips":["Keep the leading '/' on paths; percent-encode unsafe characters","Avoid asterisk-form targets — the parser does not support them","Bracket IPv6 literals in absolute targets"],"tags":["input","raw-http","url","parsing"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}