{"id":"d998d8f028470c18","repo":"labstack/echo","slug":"can-not-parse-s-w","errorCode":null,"errorMessage":"can not parse %s: %w","messagePattern":"can not parse (.+?): %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"middleware/util.go","lineNumber":121,"sourceCode":"\t\t\t\treturn string(b[:length])\n\t\t\t}\n\t\t}\n\t}\n}\n\nfunc validateOrigins(origins []string, what string) error {\n\tfor _, o := range origins {\n\t\tif err := validateOrigin(o, what); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validateOrigin(origin string, what string) error {\n\tu, err := url.Parse(origin)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"can not parse %s: %w\", what, err)\n\t}\n\tif u.Scheme == \"\" || u.Host == \"\" {\n\t\treturn fmt.Errorf(\"%s is missing scheme or host: %s\", what, origin)\n\t}\n\tif u.Path != \"\" || u.RawQuery != \"\" || u.Fragment != \"\" {\n\t\treturn fmt.Errorf(\"%s can not have path, query, and fragments: %s\", what, origin)\n\t}\n\treturn nil\n}\n","sourceCodeStart":103,"sourceCodeEnd":131,"githubUrl":"https://github.com/labstack/echo/blob/05489dc1730161df26b72d1ae2a3ba6fb8178fc7/middleware/util.go#L103-L131","documentation":"Returned by validateOrigin() (util.go:121) when url.Parse(origin) fails for a configured origin string. validateOrigin is used by CORS (cors.go:185) and CSRF (csrf.go:153) middleware to validate AllowOrigins / TrustedOrigins entries. The '%s' is the 'what' label (e.g. 'allow origin', 'trusted origin').","triggerScenarios":"Passing an origin string to CORS AllowOrigins or CSRF TrustedOrigins that url.Parse rejects: control characters, backslashes in the scheme, or otherwise malformed URLs. This is caught at middleware construction (ToMiddleware).","commonSituations":"Loading origins from an environment variable or config file that contains stray whitespace/control chars; typos like 'http//example.com'; copy-paste artifacts; origins with spaces.","solutions":["Trim whitespace and validate each origin with url.Parse before configuring the middleware.","Use the standard 'scheme://host' form (e.g. 'https://example.com').","Sanitize config-sourced origin lists at startup.","For wildcard needs use '*' in CORS AllowOrigins rather than malformed entries."],"exampleFix":"// before\norigins := strings.Split(os.Getenv(\"ORIGINS\"), \",\") // may include spaces/newlines\ncfg := middleware.CORSConfig{AllowOrigins: origins}\n// after\nvar clean []string\nfor _, o := range strings.Split(os.Getenv(\"ORIGINS\"), \",\") {\n    if o = strings.TrimSpace(o); o != \"\" {\n        clean = append(clean, o)\n    }\n}\ncfg := middleware.CORSConfig{AllowOrigins: clean}","handlingStrategy":"validation","validationCode":"func cleanOrigins(raw []string) ([]string, error) {\n    var out []string\n    for _, o := range raw {\n        o = strings.TrimSpace(o)\n        if o == \"\" { continue }\n        if _, err := url.Parse(o); err != nil {\n            return nil, fmt.Errorf(\"invalid origin %q: %w\", o, err)\n        }\n        out = append(out, o)\n    }\n    return out, nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Sanitize origin lists sourced from env/config: trim whitespace, drop empties.","Validate with url.Parse before passing to CORS/CSRF middleware.","Use '*' for CORS wildcard rather than malformed entries."],"tags":["config","cors","csrf","url","startup"],"analyzedSha":"05489dc1730161df26b72d1ae2a3ba6fb8178fc7","analyzedAt":"2026-08-04T21:32:47.783Z","schemaVersion":2}