{"record":{"id":"ef37c6dc394a6895","repo":"zeroclaw-labs/zeroclaw","slug":"refusing-to-transmit-sensitive-data-over-non-https-ef37c6","errorCode":null,"errorMessage":"Refusing to transmit sensitive data over non-HTTPS URL: URL scheme must be https","messagePattern":"Refusing to transmit sensitive data over non-HTTPS URL: URL scheme must be https","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/composio.rs","lineNumber":19,"sourceCode":"use anyhow::Context;\nuse async_trait::async_trait;\nuse parking_lot::RwLock;\nuse reqwest::Client;\nuse serde::{Deserialize, Serialize};\nuse serde_json::json;\nuse std::collections::HashMap;\nuse std::fmt::Write;\nuse std::sync::Arc;\nuse zeroclaw_api::tool::{Tool, ToolOutput, ToolResult};\nuse zeroclaw_config::policy::SecurityPolicy;\nuse zeroclaw_config::policy::ToolOperation;\n\nconst COMPOSIO_API_BASE_V3: &str = \"https://backend.composio.dev/api/v3\";\nconst COMPOSIO_TOOL_VERSION_LATEST: &str = \"latest\";\n\nfn ensure_https(url: &str) -> anyhow::Result<()> {\n    if !url.starts_with(\"https://\") {\n        anyhow::bail!(\n            \"Refusing to transmit sensitive data over non-HTTPS URL: URL scheme must be https\"\n        );\n    }\n    Ok(())\n}\n\n/// A tool that proxies actions to the Composio managed tool platform.\npub struct ComposioTool {\n    api_key: String,\n    default_entity_id: String,\n    security: Arc<SecurityPolicy>,\n    recent_connected_accounts: RwLock<HashMap<String, String>>,\n    action_slug_cache: RwLock<HashMap<String, String>>,\n}\n\nimpl ComposioTool {\n    pub fn new(\n        api_key: &str,","sourceCodeStart":1,"sourceCodeEnd":37,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/composio.rs#L1-L37","documentation":"ensure_https (composio.rs:17-24) refuses to send a request whose URL does not start with 'https://' because the x-api-key header carrying the Composio API key is about to be transmitted. It guards the execute and schema-lookup endpoints (called at composio.rs:386 and 487) whose URLs are built from the constant COMPOSIO_API_BASE_V3 = \"https://backend.composio.dev/api/v3\" (composio.rs:14). In a stock build the check can never fail; it fires only when that base has been changed to a non-https value (fork, patch, or a config-driven override).","triggerScenarios":"Any code path hitting execute_action_v3 (tool action='execute') or get_tool_schema after COMPOSIO_API_BASE_V3 was repointed at an http:// URL, e.g. 'http://localhost:8080/api/v3' for a local mock or an http reverse proxy. Also triggered by test builds that inject an http base.","commonSituations":"Developers standing up a local Composio proxy for offline testing and switching the base to plain http; CI builds with an env-override patch; forks adding self-hosted gateway support without TLS.","solutions":["Restore the https base: const COMPOSIO_API_BASE_V3: &str = \"https://backend.composio.dev/api/v3\".","For local testing, put TLS in front of the proxy (e.g. an https-terminating reverse proxy with a trusted cert) and point the base at the https URL.","Audit any patch/config layer that rewrites the Composio base URL and remove http overrides."],"exampleFix":"// before (patched build)\nconst COMPOSIO_API_BASE_V3: &str = \"http://localhost:8080/api/v3\";\n\n// after\nconst COMPOSIO_API_BASE_V3: &str = \"https://backend.composio.dev/api/v3\";\n// local proxies: terminate TLS locally and use an https:// base","handlingStrategy":"validation","validationCode":"fn ensure_https_base(base: &str) -> anyhow::Result<()> {\n    anyhow::ensure!(\n        base.starts_with(\"https://\"),\n        \"Composio base URL must use https: {base}\"\n    );\n    Ok(())\n}\n\n// at startup, after resolving whatever base your build uses:\n// ensure_https_base(&resolved_composio_base)?;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the Composio base URL https in every build and override layer.","Terminate TLS locally (reverse proxy) when testing against a local gateway; never downgrade to http.","Treat this error as a build/config smell: in stock builds it is unreachable, so seeing it means someone changed the base."],"tags":["security","https","composio","rust","zeroclaw"],"backgroundTag":"https-url-required","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}