composer/composer · error · \RuntimeException

unsupported `%s` syntax

Error message

unsupported `%s` syntax

What it means

In ProxyItem::__construct, the proxy URL (from HTTP_PROXY/HTTPS_PROXY/etc.) contains a carriage return, newline, or tab character. Composer rejects it outright at src/Composer/Util/Http/ProxyItem.php:42 to prevent CRLF/header-injection through proxy environment variables.

Source

Thrown at src/Composer/Util/Http/ProxyItem.php:42

    private $safeUrl;
    /** @var ?non-empty-string */
    private $curlAuth;
    /** @var string */
    private $optionsProxy;
    /** @var ?non-empty-string */
    private $optionsAuth;

    /**
     * @param string $proxyUrl The value from the environment
     * @param string $envName The name of the environment variable
     * @throws \RuntimeException If the proxy url is invalid
     */
    public function __construct(string $proxyUrl, string $envName)
    {
        $syntaxError = sprintf('unsupported `%s` syntax', $envName);

        if (strpbrk($proxyUrl, "\r\n\t") !== false) {
            throw new \RuntimeException($syntaxError);
        }
        if (false === ($proxy = parse_url($proxyUrl))) {
            throw new \RuntimeException($syntaxError);
        }
        if (!isset($proxy['host'])) {
            throw new \RuntimeException('unable to find proxy host in ' . $envName);
        }

        $scheme = isset($proxy['scheme']) ? strtolower($proxy['scheme']) . '://' : 'http://';
        $safe = '';

        if (isset($proxy['user'])) {
            $safe = '***';
            $user = $proxy['user'];
            $auth = rawurldecode($proxy['user']);

            if (isset($proxy['pass'])) {
                $safe .= ':***';

View on GitHub (pinned to c435d285c9)

Solutions

1. Strip CR/LF/tab from the proxy env var: `export HTTPS_PROXY="$(printf '%s' "$HTTPS_PROXY" | tr -d '\r\n\t')"`.
2. Re-enter the value in .env/CI secret on a single line with no spanning quotes.
3. Validate the proxy var at deploy time before invoking Composer.

Example fix

# before (.env, broken across lines)
HTTPS_PROXY="http://proxy.corp.example.com:\
8080"

# after
HTTPS_PROXY="http://proxy.corp.example.com:8080"

$proxy = getenv('HTTPS_PROXY') ?: '';
if ($proxy !== '' && strpbrk($proxy, "\r\n\t") !== false) {
    throw new \InvalidArgumentException('HTTPS_PROXY contains illegal CR/LF/tab characters.');
}

try {
    $proxy = new \Composer\Util\Http\ProxyItem($val, 'HTTPS_PROXY');
} catch (\RuntimeException $e) {
    if ($e->getMessage() === sprintf('unsupported `%s` syntax', 'HTTPS_PROXY')) {
        // sanitize the value (strip CR/LF/tab) and retry, or fail fast with guidance
    }
    throw $e;
}

When it happens

Trigger: Constructing a ProxyItem (via ProxyManager) when the env var value has embedded `\r`, `\n`, or `\t` — the strpbrk check on line 41 returns non-false.

Common situations: Multi-line values in .env files that accidentally include newlines; a CI secret-injection wrapping the value with stray CR/LF; copy-paste from a Windows editor adding CR; a templated value that appended a trailing newline.

Related errors

• unable to find proxy host in {$envName}
• unable to find proxy port in {$envName}
• port 0 is reserved in {$envName}
• Your configuration does not allow connections to {url}. See
• Your configuration does not allow connections to {url}. See

AI-assisted analysis of composer/composer@c435d285c9 (2026-08-07). Data as JSON: /api/errors/3c430caed388354a. Report an issue: GitHub.