{"record":{"id":"f93b3052f52036ea","repo":"abhigyanpatwari/GitNexus","slug":"invalid-url","errorCode":null,"errorMessage":"Invalid URL","messagePattern":"Invalid URL","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"gitnexus/src/server/git-clone.ts","lineNumber":83,"sourceCode":"// Cloud metadata hostnames that must never be reachable via user-supplied URLs\nconst BLOCKED_HOSTNAMES = new Set([\n  'localhost',\n  'metadata.google.internal',\n  'metadata.azure.com',\n  'metadata.internal',\n]);\n\n/**\n * Validate a git URL to prevent SSRF attacks.\n * Only allows https:// and http:// schemes. Blocks private/internal addresses,\n * IPv6 private ranges, cloud metadata hostnames, and numeric IP encodings.\n */\nexport function validateGitUrl(url: string): void {\n  let parsed: URL;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error('Invalid URL');\n  }\n\n  if (!['https:', 'http:'].includes(parsed.protocol)) {\n    throw new Error('Only https:// and http:// git URLs are allowed');\n  }\n\n  const host = parsed.hostname.toLowerCase();\n\n  // Block known dangerous hostnames (cloud metadata services)\n  if (BLOCKED_HOSTNAMES.has(host)) {\n    throw new Error('Cloning from private/internal addresses is not allowed');\n  }\n\n  // Strip IPv6 brackets if present (URL parser behavior varies across Node versions)\n  let normalizedHost = host;\n  if (host.startsWith('[') && host.endsWith(']')) {\n    normalizedHost = host.slice(1, -1);\n  }","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/aac7515d2a8c50a1f8f923c6fb77218b333560d6/gitnexus/src/server/git-clone.ts#L65-L101","documentation":"validateGitUrl's first step parses the input with new URL(); any string the WHATWG URL parser rejects — missing scheme, embedded spaces/control characters, bare 'github.com/user/repo' — throws and is rethrown as 'Invalid URL'. This is the malformed-input gate in front of the SSRF checks that follow.","triggerScenarios":"POST /api/analyze with url lacking a scheme ('github.com/user/repo.git'), containing raw spaces or newlines ('https:// ex ample.com'), or otherwise unparseable garbage such as pasted placeholder text.","commonSituations":"Users omitting https:// because git itself tolerates it; copy-paste introducing whitespace or a newline; frontends not trimming the field; scp-style 'git@host:repo' syntax, which the URL parser cannot parse at all.","solutions":["Trim whitespace/newlines from the URL before submitting","Prepend https:// when the scheme is missing","Run new URL(url) client-side as a pre-flight check","Convert scp-style git@host:repo remotes to https://host/repo form"],"exampleFix":"// before\nconst url = 'github.com/user/repo.git';\nvalidateGitUrl(url); // Invalid URL\n\n// after\nconst url = 'https://github.com/user/repo.git';\nvalidateGitUrl(url); // ok","handlingStrategy":"validation","validationCode":"function isParseableHttpUrl(s) {\n  if (typeof s !== 'string') return false;\n  try { const u = new URL(s.trim()); return u.protocol === 'https:' || u.protocol === 'http:'; }\n  catch { return false; }\n}","typeGuard":"function asTrimmedAbsoluteUrl(raw) {\n  const s = typeof raw === 'string' ? raw.trim() : '';\n  if (!s) return null;\n  const withScheme = /^[a-z][a-z0-9+.-]*:/i.test(s) ? s : `https://${s}`;\n  try { return new URL(withScheme).href; } catch { return null; }\n}","tryCatchPattern":"try { validateGitUrl(url); }\ncatch (e) {\n  if (e.message === 'Invalid URL') { const fixed = asTrimmedAbsoluteUrl(url); if (!fixed) throw e; validateGitUrl(fixed); }\n  else throw e;\n}","preventionTips":["Trim pasted URLs and strip newlines before submitting","Auto-prepend https:// when the scheme is missing","Run new URL() in the client as the cheapest possible pre-flight"],"tags":["git-clone","url-parsing","validation","ssrf-guard"],"backgroundTag":"malformed-url","analyzedSha":"aac7515d2a8c50a1f8f923c6fb77218b333560d6","analyzedAt":"2026-08-20T23:29:22.980Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}