{"record":{"id":"e4ba9a69fcfb379c","repo":"epi052/feroxbuster","slug":"word-word-from-wordlist-is-a-url-skipping","errorCode":null,"errorMessage":"word ({word}) from wordlist is a URL, skipping...","messagePattern":"word \\((.+?)\\) from wordlist is a URL, skipping\\.\\.\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/url.rs","lineNumber":173,"sourceCode":"\n    /// Simple helper to generate a `Url`\n    ///\n    /// Errors during parsing `url` or joining `word` are propagated up the call stack\n    pub fn format(&self, word: &str, extension: Option<&str>) -> Result<Url> {\n        log::trace!(\"enter: format({word}, {extension:?})\");\n\n        if Url::parse(word).is_ok() {\n            // when a full url is passed in as a word to be joined to a base url using\n            // reqwest::Url::join, the result is that the word (url) completely overwrites the base\n            // url, potentially resulting in requests to places that aren't actually the target\n            // specified.\n            //\n            // in order to resolve the issue, we check if the word from the wordlist is a parsable URL\n            // and if so, don't do any further processing\n            let message = format!(\"word ({word}) from wordlist is a URL, skipping...\");\n            log::warn!(\"{message}\");\n            log::trace!(\"exit: format -> Err({message})\");\n            bail!(message);\n        }\n\n        // from reqwest::Url::join\n        //   Note: a trailing slash is significant. Without it, the last path component\n        //   is considered to be a “file” name to be removed to get at the “directory”\n        //   that is used as the base\n        //\n        // the transforms that occur here will need to keep this in mind, i.e. add a slash to preserve\n        // the current directory sent as part of the url\n        let url = if word.is_empty() {\n            // v1.0.6: added during --extract-links feature implementation to support creating urls\n            // that were extracted from response bodies, i.e. http://localhost/some/path/js/main.js\n            self.target.to_string()\n        } else if !self.target.ends_with('/') {\n            format!(\"{}/\", self.target)\n        } else {\n            self.target.to_string()\n        };","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/epi052/feroxbuster/blob/1f595dab5c76858d5a14fbc47dabf2563d729c62/src/url.rs#L155-L191","documentation":"Url::format is responsible for turning a wordlist word into a request URL joined against the target. If the word itself parses as a complete URL, joining it to the base would produce wrong results (Url::join replaces the base), so the function logs a warning and returns an error to skip that word.","triggerScenarios":"A wordlist contains a full URL (e.g. 'https://example.com/admin') instead of a bare path word; during format() the word passes Url::parse successfully and has the expected scheme, so processing is skipped.","commonSituations":"Using wordlists scraped from the web that contain absolute URLs, mixing recursive-scan output back into a wordlist, or accidentally pointing --wordlists at a file of URLs rather than words.","solutions":["Clean the wordlist to contain only bare path words (strip scheme://host prefixes)","Use a standard wordlist (e.g. seclists raw path lists) rather than URL lists","Ignore the warning - the word is safely skipped and scanning continues","Strip the target base from collected URLs before re-feeding them as a wordlist"],"exampleFix":"// before (wordlist.txt)\nhttps://example.com/admin\n// after (wordlist.txt)\nadmin","handlingStrategy":"validation","validationCode":"const is_full_url = (w: string) => /^[a-zA-Z][a-zA-Z0-9+.-]*:\\/\\//.test(w);\nconst words = wordlist.filter(w => !is_full_url(w.trim()));","typeGuard":"function isFullUrl(word: string): boolean {\n  try { return !!new URL(word) && new URL(word).origin !== 'null'; } catch { return false; }\n}","tryCatchPattern":null,"preventionTips":["Strip scheme://host from words before building wordlists","Use plain path wordlists (e.g. seclists)","Treat this warning as a skipped word, not a fatal error"],"tags":["wordlist","url","input-validation"],"backgroundTag":"invalid-url-format","analyzedSha":"1f595dab5c76858d5a14fbc47dabf2563d729c62","analyzedAt":"2026-09-13T19:33:06.208Z","contentChangedAt":"2026-09-13T19:33:06.208Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}