jdx/mise · error

`url` must not start with `-`

Error message

`url` must not start with `-`

What it means

The trimmed `url` must not begin with `-`, because it is later passed to git as an argument and a leading dash would be parsed as an option/flag rather than a URL. This is an argument-injection guard.

Source

Thrown at src/system/repos.rs:130

            // Join only the Normal segments so `./foobar` resolves to
            // `<root>/foobar` rather than `<root>/./foobar` — a `.` component
            // survives `Path::join` and leaks into every displayed path.
            let mut resolved = root.to_path_buf();
            for component in path.components() {
                if let Component::Normal(segment) = component {
                    resolved.push(segment);
                }
            }
            resolved
        };
        let Some(url) = config.url.map(|s| s.trim().to_string()) else {
            bail!("must set `url`");
        };
        if url.is_empty() {
            bail!("must set a non-empty `url`");
        }
        if url.starts_with('-') {
            bail!("`url` must not start with `-`");
        }
        let git_ref = config.git_ref.map(|s| s.trim().to_string());
        let git_ref = match git_ref {
            Some(git_ref) if git_ref.is_empty() => bail!("`ref` must not be empty"),
            Some(git_ref) if git_ref.starts_with('-') => bail!("`ref` must not start with `-`"),
            other => other,
        };
        Ok(Self {
            path_raw,
            path,
            url,
            git_ref,
        })
    }
}

impl std::fmt::Display for RepoRequest {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Move any git flags out of `url`; the url must be a repo URL or path.
2. If you need extra git options, check whether the repos module exposes a dedicated flags field.
3. Quote/inspect the config source to ensure field ordering was not scrambled.

Example fix

// before
[[repos]]
path = "repo"
url = "--depth=1 https://github.com/org/repo.git"

// after
[[repos]]
path = "repo"
url = "https://github.com/org/repo.git"

fn is_safe_url(url: &str) -> bool {
    let u = url.trim();
    !u.is_empty() && !u.starts_with('-')
}

When it happens

Trigger: Calling from_toml with `url = "--upload-pack=..."` or any value starting with a hyphen.

Common situations: Adversarial or accidentally misplaced values (e.g. a flag pasted into the url slot); generated configs where fields got shifted.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

• `ref` must not start with `-`
• [dotfiles]."{}": target is not a safe OCI path
• remote cache URL must use HTTPS except for loopback developm
• Paranoid mode is enabled, refusing to install community-deve
• trust the configuration before using its encryption recipien

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/7002b492bd214b80. Report an issue: GitHub.