epi052/feroxbuster · error

url to parse has no authority and is therefore invalid

Error message

url to parse has no authority and is therefore invalid

What it means

parse_url_with_raw_path wraps reqwest's Url::parse and then validates the result. A URL may parse correctly (e.g. 'mailto:user@host' or 'tel:123') but have no authority component; since feroxbuster needs a host to scan, such URLs are rejected with this message.

Solutions

1. Provide an http:// or https:// URL with a hostname for -u and other target inputs
2. Filter out mailto:/tel:/data: links before feeding discovered URLs into feroxbuster
3. Sanitize request files (--request-from-file raw requests) to target http(s) hosts only

Example fix

// before
feroxbuster -u mailto:admin@example.com
// after
feroxbuster -u https://example.com

function hasAuthority(url) {
  try { const u = new URL(url); return !!u.hostname; } catch { return false; }
}
if (!hasAuthority(candidateUrl)) throw new Error('url to parse has no authority and is therefore invalid');

function isHttpUrl(s: unknown): s is string {
  if (typeof s !== 'string') return false;
  try { const u = new URL(s); return u.protocol === 'http:' || u.protocol === 'https:'; } catch { return false; }
}

// caller
match parse_url_with_raw_path(candidate) {
    Ok(url) => { /* use */ }
    Err(_) => log::debug!("skipping non-authority url: {candidate}"),
}

When it happens

Trigger: Calling parse_url_with_raw_path (from CLI args parsing, request-file parsing, -u targets, or discovered-link parsing like ordered_scan_url / parse_url_and_add_subpaths) with a URL that has no authority/host, such as mailto:, tel:, or data: URIs.

Common situations: Passing '-u mailto:foo@bar.com' by mistake, a proxy/request raw file containing non-http URLs, or crawled page content yielding mailto:/tel: links that get fed into URL parsing.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• url to parse doesn't have a host
• Empty query string provided
• Empty key in query string
• Empty header provided
• Empty header name provided

AI-assisted analysis of epi052/feroxbuster@1f595dab5c (2026-09-13). Data as JSON: /api/errors/d6d7769df80188d3. Report an issue: GitHub.

Appendix: source

Thrown at src/utils.rs:636

/// This function takes a url string and returns a `url::Url`
///
/// It is primarily used to detect url paths that `url::Url::parse` will
/// silently transform, such as /path/../file.html -> /file.html
///
/// # Warning
///
/// In the instance of a url with encoded path traversal strings, such as
/// /path/%2e%2e/file.html, the underlying `url::Url::parse` will
/// further encode the %-signs and return /path/%252e%252e/file.html
pub fn parse_url_with_raw_path(url: &str) -> Result<Url> {
    log::trace!("enter: parse_url_with_raw_path({url})");

    let parsed = Url::parse(url)?;

    if !parsed.has_authority() {
        // parsed correctly, but no authority, meaning mailto: or tel: or
        // some other url that we don't care about
        bail!("url to parse has no authority and is therefore invalid");
    }

    // thanks to @devx00: the possibility exists for Url to return true for
    // has_authority, but not have a host/port, so we'll check for that
    // and bail if it's the case
    if parsed.host().is_none() {
        bail!("url to parse doesn't have a host");
    }

    // we have a valid url, the next step is to check the path and see if it's
    // something that url::Url::parse would silently transform
    //
    // i.e. if the path is /path/../file.html, url::Url::parse will transform it
    // to /file.html, which is not what we want

    let farthest_right_authority_part;

    // we want to find the farthest right authority component, which is the

View on GitHub (pinned to 1f595dab5c)