What causes "Url cannot be None." in google/tsunami-security-scanner?

Log/inspect the url value at the call site; trace where it is sourced from

google/tsunami-security-scanner · error · ValueError

Url cannot be None.

Error message

Url cannot be None.

What it means

The check_url_argument decorator wraps HttpRequest factory functions and rejects falsy URLs before the underlying constructor runs. This library throws it so a request object is never created with a missing URL, which would fail later at send time with a less obvious error.

Solutions

Log/inspect the url value at the call site; trace where it is sourced from
Guard the call: only build the request if the url is a non-empty string
Fix the configuration/env var that should supply the target URL
Provide a sensible default or fail fast upstream with a clearer message

Example fix

// before
req = HttpRequest.of(config.target_url)  # may be None
// after
if not config.target_url:
  raise ValueError('target_url must be configured before sending a request')
req = HttpRequest.of(config.target_url)

Defensive patterns

Strategy: validation

Validate before calling

def build_request_checked(cls, url):
    if not isinstance(url, str) or not url:
        raise ValueError('target URL must be a non-empty string')
    return HttpRequest.of(url)

Type guard

def has_url(url) -> bool:
    return isinstance(url, str) and bool(url.strip())

Try / catch

try:
    req = HttpRequest.of(url)
except ValueError:
    logging.error('Missing target URL; check config/env')
    return None

Prevention

Validate scan config URLs at startup, before any request building
Use explicit None checks rather than truthiness when defaults like '' are meaningful
Keep url parameter ordering stable when calling builders positionally

When it happens

Trigger: Calling an HttpRequest builder with url=None, url='' or any falsy value, e.g. HttpRequest.of(None) or a builder whose url parameter is sourced from an unset config/CLI field.

Common situations: Target URL read from an environment variable or scan config that is unset; a plugin computing the URL from request data that was absent; refactors renaming the url parameter so positional args shifted.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of google/tsunami-security-scanner@363ba87b35 (2026-09-13). Data as JSON: /api/errors/4f8304247124a833. Report an issue: GitHub.

Appendix: source

Thrown at plugin_server/py/common/net/http/http_request.py:13

"""HTTP request utility."""

from typing import Optional

from common.net.http.http_headers import Builder as HttpHeadersBuilder
from common.net.http.http_headers import HttpHeaders
from common.net.http.http_method import HttpMethod


def check_url_argument(func):
  def wrapper(cls, url):
    if not url:
      raise ValueError('Url cannot be None.')
    return func(cls, url)
  return wrapper


class HttpRequest:
  """HTTP request utility class.

  Please use Builder() to create instances of this class.

  Attributes:
    method: The HTTP request type.
    url: String address of the request.
    headers: The HTTP request headers in key/value pairs.
    body: The HTTP body could be empty per the request type. GET and
      HEAD request types must have empty request_body.
  """

  def __init__(self):

View on GitHub (pinned to 363ba87b35)