lissy93/web-check · error · Error

Invalid URL format

Error message

Invalid URL format

What it means

securityTxtHandler prepends 'https://' when the input lacks '://' and constructs a URL. If the URL constructor throws, the generic 'Invalid URL format' error is thrown. The URL's pathname is then cleared and well-known security.txt paths are probed, so a valid origin is mandatory.

Source

Thrown at api/security-txt.js:44

    }
  }

  return output;
};

const isPgpSigned = (result) => {
  if (result.includes('-----BEGIN PGP SIGNED MESSAGE-----')) {
    return true;
  }
  return false;
};

const securityTxtHandler = async (urlParam) => {
  let url;
  try {
    url = new URL(urlParam.includes('://') ? urlParam : 'https://' + urlParam);
  } catch (error) {
    throw new Error('Invalid URL format');
  }
  url.pathname = '';

  for (let path of SECURITY_TXT_PATHS) {
    try {
      const result = await fetchSecurityTxt(url, path);
      if (result && result.toLowerCase().includes('<html')) continue;
      if (result) {
        return {
          isPresent: true,
          foundIn: path,
          content: result,
          isPgpSigned: isPgpSigned(result),
          fields: parseResult(result),
        };
      }
    } catch (error) {
      throw new Error(error.message);

View on GitHub (pinned to af1a97759f)

Solutions

1. Pass a clean hostname or full http(s) URL; strip surrounding whitespace
2. Avoid inputs with a colon but no '://' (e.g. mailto:), which bypass scheme prepending
3. Validate with new URL(input.includes('://') ? input : 'https://' + input) client-side first

Example fix

// before
securityTxtHandler('example.com:80:443'); // Invalid URL format

// after
securityTxtHandler('example.com'.trim());

const norm = (s) => s.includes('://') ? s : 'https://' + s;
try { new URL(norm(input)); } catch { return badRequest('invalid url'); }
const findings = await securityTxtHandler(input);

const isParseableWebTarget = (v) => {
  if (typeof v !== 'string') return false;
  try { const u = new URL(v.includes('://') ? v : 'https://' + v); return !!u.hostname; } catch { return false; }
};

try { await securityTxtHandler(url); }
catch (e) {
  if (e.message === 'Invalid URL format') return badRequest('provide a valid hostname or URL');
  throw e;
}

When it happens

Trigger: Inputs like 'example.com:notaport', 'https://', 'exa mple.com', or strings whose hostname portion cannot parse after scheme prepending.

Common situations: Users passing bare hostnames works, but malformed ports/hosts or whitespace-laden input fails; also inputs like 'mailto:someone' contain ':' but not '://', so they are passed raw and fail parsing.

Related errors

• URL provided is invalid
• No target provided
• Invalid URL: ${input}
• URL is missing from queryStringParameters
• You must provide a URL query parameter!

AI-assisted analysis of lissy93/web-check@af1a97759f (2026-08-27). Data as JSON: /api/errors/d702d31947c2dcea. Report an issue: GitHub.