{"record":{"id":"fa87372142d7f3f1","repo":"affaan-m/ECC","slug":"missing-value-for-target","errorCode":null,"errorMessage":"Missing value for --target","messagePattern":"Missing value for --target","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"scripts/catalog.js","lineNumber":85,"sourceCode":"\n  parsed.command = args[0];\n\n  for (let index = 1; index < args.length; index += 1) {\n    const arg = args[index];\n\n    if (arg === '--help' || arg === '-h') {\n      parsed.help = true;\n    } else if (arg === '--json') {\n      parsed.json = true;\n    } else if (arg === '--family') {\n      if (!args[index + 1]) {\n        throw new Error('Missing value for --family');\n      }\n      parsed.family = normalizeFamily(args[index + 1]);\n      index += 1;\n    } else if (arg === '--target') {\n      if (!args[index + 1]) {\n        throw new Error('Missing value for --target');\n      }\n      parsed.target = args[index + 1];\n      index += 1;\n    } else if (parsed.command === 'show' && !parsed.componentId) {\n      parsed.componentId = arg;\n    } else {\n      throw new Error(`Unknown argument: ${arg}`);\n    }\n  }\n\n  return parsed;\n}\n\nfunction printProfiles(profiles) {\n  console.log('Install profiles:\\n');\n  for (const profile of profiles) {\n    console.log(`- ${profile.id} (${profile.moduleCount} modules)`);\n    console.log(`  ${profile.description}`);","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/scripts/catalog.js#L67-L103","documentation":"_validate_import_url() enforces HTTPS-only for remote instinct imports. Any URL whose scheme is not exactly 'https' (http, ftp, file, git, ssh, etc.) is rejected before any DNS lookup or network connection is opened. This prevents plaintext credential leakage and man-in-the-middle content tampering on an import path that writes files to disk.","triggerScenarios":"Passing 'http://example.com/instinct.md'; 'ftp://host/file'; 'file:///etc/passwd'; 'git://host/repo'.","commonSituations":"Copying a URL from internal docs that uses plain http; pointing at a localhost dev server over http; a URL field that accepted any scheme upstream.","solutions":["Use an https URL for the remote instinct file.","For local development, import the local file directly via its filesystem path instead of a URL.","If you control the host, enable TLS (e.g. via a reverse proxy or Let's Encrypt) and switch the URL to https."],"exampleFix":"# before\n_validate_import_url('http://example.com/instinct.md')  # rejected\n\n# after\n_validate_import_url('https://example.com/instinct.md')","handlingStrategy":"validation","validationCode":"# Reject non-https URLs at the boundary, before any import call.\nimport urllib.parse\nparsed = urllib.parse.urlparse(source)\nif parsed.scheme != 'https':\n    raise SystemExit(f'remote instinct imports require https; got scheme {parsed.scheme!r}')","typeGuard":"import urllib.parse\n\ndef is_https_url(s) -> bool:\n    return urllib.parse.urlparse(s).scheme == 'https'","tryCatchPattern":"try:\n    content = _fetch_import_url(source)\nexcept ValueError as e:\n    if 'https' in str(e):\n        source = source.replace('http://', 'https://', 1)  # only if you trust the host\n        content = _fetch_import_url(source)\n    else:\n        raise","preventionTips":["Always use https URLs for remote imports.","For local dev, import the local file rather than spinning up a plain-http server.","Validate the scheme at the input boundary, before it reaches the fetch layer."],"tags":["security","network","https","ssrf","validation"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}