epi052/feroxbuster · error

url to parse doesn't have a host

Error message

url to parse doesn't have a host

What it means

parse_url_with_raw_path validates a URL string before handing it to url::Url parsing. Because url::Url can report has_authority while still returning no host (e.g. bare scheme-like inputs), this check bails when parsed.host() is None to avoid later logic assuming a host/port exists.

Solutions

1. Fix the input URL to include a host, e.g. 'http://localhost' instead of 'http://'
2. Pre-validate with a regex or Url::parse and check url.host().is_some() before calling
3. Strip or skip empty/malformed entries when reading targets from files or wordlists

Example fix

// before
parse_url_with_raw_path("http://")?;
// after
parse_url_with_raw_path("http://localhost:8000")?;

fn has_host(u: &str) -> bool { url::Url::parse(u).map(|p| p.host().is_some()).unwrap_or(false) }
if !has_host(candidate) { skip_or_report(candidate); }

fn is_parseable_url(s: &str) -> Option<url::Url> { url::Url::parse(s).ok().filter(|u| u.host().is_some()) }

match parse_url_with_raw_path(input) { Ok(u) => scan(u), Err(e) if e.to_string().contains("doesn't have a host") => warn_and_skip(input), Err(e) => return Err(e) }

When it happens

Trigger: Passing a string that parses as an absolute URL with an authority component but no resolvable host, such as 'http://' or 'http:///path', into parse_url_with_raw_path — directly or via check_for_updates, parse_url_with_no_base_correction, parse_cli_args, parse_request_file, ordered_scan_url, or parse_url_and_add_subpaths.

Common situations: A raw request file whose first line is malformed ('http:///foo'), a mistyped --url CLI argument, or scan targets read from a wordlist/file containing scheme-only entries like 'http://'.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• url to parse has no authority and is therefore invalid
• Empty query string provided
• Empty key in query string
• Empty header provided
• Empty header name provided

AI-assisted analysis of epi052/feroxbuster@1f595dab5c (2026-09-13). Data as JSON: /api/errors/b1a02d4c0cadcfeb. Report an issue: GitHub.

Appendix: source

Thrown at src/utils.rs:643

/// In the instance of a url with encoded path traversal strings, such as
/// /path/%2e%2e/file.html, the underlying `url::Url::parse` will
/// further encode the %-signs and return /path/%252e%252e/file.html
pub fn parse_url_with_raw_path(url: &str) -> Result<Url> {
    log::trace!("enter: parse_url_with_raw_path({url})");

    let parsed = Url::parse(url)?;

    if !parsed.has_authority() {
        // parsed correctly, but no authority, meaning mailto: or tel: or
        // some other url that we don't care about
        bail!("url to parse has no authority and is therefore invalid");
    }

    // thanks to @devx00: the possibility exists for Url to return true for
    // has_authority, but not have a host/port, so we'll check for that
    // and bail if it's the case
    if parsed.host().is_none() {
        bail!("url to parse doesn't have a host");
    }

    // we have a valid url, the next step is to check the path and see if it's
    // something that url::Url::parse would silently transform
    //
    // i.e. if the path is /path/../file.html, url::Url::parse will transform it
    // to /file.html, which is not what we want

    let farthest_right_authority_part;

    // we want to find the farthest right authority component, which is the
    // component that is the furthest right in the url that is part of the
    // authority
    //
    // per RFC 3986, the authority is defined as:
    // - authority = [ userinfo "@" ] host [ ":" port ]
    //
    // so the farthest right authority component is either the port or the host

View on GitHub (pinned to 1f595dab5c)