{"record":{"id":"d6d7769df80188d3","repo":"epi052/feroxbuster","slug":"url-to-parse-has-no-authority-and-is-therefore-invalid","errorCode":null,"errorMessage":"url to parse has no authority and is therefore invalid","messagePattern":"url to parse has no authority and is therefore invalid","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/utils.rs","lineNumber":636,"sourceCode":"/// This function takes a url string and returns a `url::Url`\n///\n/// It is primarily used to detect url paths that `url::Url::parse` will\n/// silently transform, such as /path/../file.html -> /file.html\n///\n/// # Warning\n///\n/// In the instance of a url with encoded path traversal strings, such as\n/// /path/%2e%2e/file.html, the underlying `url::Url::parse` will\n/// further encode the %-signs and return /path/%252e%252e/file.html\npub fn parse_url_with_raw_path(url: &str) -> Result<Url> {\n    log::trace!(\"enter: parse_url_with_raw_path({url})\");\n\n    let parsed = Url::parse(url)?;\n\n    if !parsed.has_authority() {\n        // parsed correctly, but no authority, meaning mailto: or tel: or\n        // some other url that we don't care about\n        bail!(\"url to parse has no authority and is therefore invalid\");\n    }\n\n    // thanks to @devx00: the possibility exists for Url to return true for\n    // has_authority, but not have a host/port, so we'll check for that\n    // and bail if it's the case\n    if parsed.host().is_none() {\n        bail!(\"url to parse doesn't have a host\");\n    }\n\n    // we have a valid url, the next step is to check the path and see if it's\n    // something that url::Url::parse would silently transform\n    //\n    // i.e. if the path is /path/../file.html, url::Url::parse will transform it\n    // to /file.html, which is not what we want\n\n    let farthest_right_authority_part;\n\n    // we want to find the farthest right authority component, which is the","sourceCodeStart":618,"sourceCodeEnd":654,"githubUrl":"https://github.com/epi052/feroxbuster/blob/1f595dab5c76858d5a14fbc47dabf2563d729c62/src/utils.rs#L618-L654","documentation":"parse_url_with_raw_path wraps reqwest's Url::parse and then validates the result. A URL may parse correctly (e.g. 'mailto:user@host' or 'tel:123') but have no authority component; since feroxbuster needs a host to scan, such URLs are rejected with this message.","triggerScenarios":"Calling parse_url_with_raw_path (from CLI args parsing, request-file parsing, -u targets, or discovered-link parsing like ordered_scan_url / parse_url_and_add_subpaths) with a URL that has no authority/host, such as mailto:, tel:, or data: URIs.","commonSituations":"Passing '-u mailto:foo@bar.com' by mistake, a proxy/request raw file containing non-http URLs, or crawled page content yielding mailto:/tel: links that get fed into URL parsing.","solutions":["Provide an http:// or https:// URL with a hostname for -u and other target inputs","Filter out mailto:/tel:/data: links before feeding discovered URLs into feroxbuster","Sanitize request files (--request-from-file raw requests) to target http(s) hosts only"],"exampleFix":"// before\nferoxbuster -u mailto:admin@example.com\n// after\nferoxbuster -u https://example.com","handlingStrategy":"validation","validationCode":"function hasAuthority(url) {\n  try { const u = new URL(url); return !!u.hostname; } catch { return false; }\n}\nif (!hasAuthority(candidateUrl)) throw new Error('url to parse has no authority and is therefore invalid');","typeGuard":"function isHttpUrl(s: unknown): s is string {\n  if (typeof s !== 'string') return false;\n  try { const u = new URL(s); return u.protocol === 'http:' || u.protocol === 'https:'; } catch { return false; }\n}","tryCatchPattern":"// caller\nmatch parse_url_with_raw_path(candidate) {\n    Ok(url) => { /* use */ }\n    Err(_) => log::debug!(\"skipping non-authority url: {candidate}\"),\n}","preventionTips":["Filter mailto:/tel:/data: URIs out of crawled link lists","Only pass http(s) URLs with hostnames as targets","Validate raw request files target http(s) hosts"],"tags":["url","validation","input"],"backgroundTag":"invalid-url-format","analyzedSha":"1f595dab5c76858d5a14fbc47dabf2563d729c62","analyzedAt":"2026-09-13T19:33:06.208Z","contentChangedAt":"2026-09-13T19:33:06.208Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}