{"record":{"id":"d702d31947c2dcea","repo":"lissy93/web-check","slug":"invalid-url-format","errorCode":null,"errorMessage":"Invalid URL format","messagePattern":"Invalid URL format","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"api/security-txt.js","lineNumber":44,"sourceCode":"    }\n  }\n\n  return output;\n};\n\nconst isPgpSigned = (result) => {\n  if (result.includes('-----BEGIN PGP SIGNED MESSAGE-----')) {\n    return true;\n  }\n  return false;\n};\n\nconst securityTxtHandler = async (urlParam) => {\n  let url;\n  try {\n    url = new URL(urlParam.includes('://') ? urlParam : 'https://' + urlParam);\n  } catch (error) {\n    throw new Error('Invalid URL format');\n  }\n  url.pathname = '';\n\n  for (let path of SECURITY_TXT_PATHS) {\n    try {\n      const result = await fetchSecurityTxt(url, path);\n      if (result && result.toLowerCase().includes('<html')) continue;\n      if (result) {\n        return {\n          isPresent: true,\n          foundIn: path,\n          content: result,\n          isPgpSigned: isPgpSigned(result),\n          fields: parseResult(result),\n        };\n      }\n    } catch (error) {\n      throw new Error(error.message);","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/lissy93/web-check/blob/af1a97759fc8bcc43c876c94f2ccb018ce215f90/api/security-txt.js#L26-L62","documentation":"securityTxtHandler prepends 'https://' when the input lacks '://' and constructs a URL. If the URL constructor throws, the generic 'Invalid URL format' error is thrown. The URL's pathname is then cleared and well-known security.txt paths are probed, so a valid origin is mandatory.","triggerScenarios":"Inputs like 'example.com:notaport', 'https://', 'exa mple.com', or strings whose hostname portion cannot parse after scheme prepending.","commonSituations":"Users passing bare hostnames works, but malformed ports/hosts or whitespace-laden input fails; also inputs like 'mailto:someone' contain ':' but not '://', so they are passed raw and fail parsing.","solutions":["Pass a clean hostname or full http(s) URL; strip surrounding whitespace","Avoid inputs with a colon but no '://' (e.g. mailto:), which bypass scheme prepending","Validate with new URL(input.includes('://') ? input : 'https://' + input) client-side first"],"exampleFix":"// before\nsecurityTxtHandler('example.com:80:443'); // Invalid URL format\n\n// after\nsecurityTxtHandler('example.com'.trim());","handlingStrategy":"type-guard","validationCode":"const norm = (s) => s.includes('://') ? s : 'https://' + s;\ntry { new URL(norm(input)); } catch { return badRequest('invalid url'); }\nconst findings = await securityTxtHandler(input);","typeGuard":"const isParseableWebTarget = (v) => {\n  if (typeof v !== 'string') return false;\n  try { const u = new URL(v.includes('://') ? v : 'https://' + v); return !!u.hostname; } catch { return false; }\n};","tryCatchPattern":"try { await securityTxtHandler(url); }\ncatch (e) {\n  if (e.message === 'Invalid URL format') return badRequest('provide a valid hostname or URL');\n  throw e;\n}","preventionTips":["Trim input and reject strings with a colon but no '://' scheme","Reject whitespace inside the host portion","Keep client-side normalisation identical to the handler's to avoid surprising mismatches"],"tags":["validation","url-parsing","security-txt","api"],"backgroundTag":"invalid-url-format","analyzedSha":"af1a97759fc8bcc43c876c94f2ccb018ce215f90","analyzedAt":"2026-08-27T11:44:27.410Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}