roboflow/supervision · error · ValueError

URL authority contains a backslash

Error message

URL authority contains a backslash

What it means

Raised during URL validation when the netloc (authority) of the URL contains a backslash. Backslashes in the authority are a classic SSRF/parser-confusion vector (browsers and server-side parsers can disagree about where the host ends), so supervision rejects them outright before letting `requests` normalize the URL.

Source

Thrown at src/supervision/utils/file.py:32

def _normalize_http_url(url: str) -> str:
    """
    Validate and normalize an HTTP(S) URL.

    Args:
        url: URL to validate.

    Returns:
        Normalized URL string.

    Raises:
        ValueError: If the URL is invalid or uses an unsupported scheme.
    """
    try:
        original_parsed_url = urllib.parse.urlparse(url)
        if "\\" in original_parsed_url.netloc:
            raise ValueError("URL authority contains a backslash")

        prepared_request = requests.Request(method="GET", url=url).prepare()
        prepared_url = prepared_request.url
        if prepared_url is None:
            raise ValueError("prepared URL is empty")

        parsed_url = urllib.parse.urlparse(prepared_url)
    except (requests.RequestException, ValueError) as error:
        raise ValueError(f"Invalid URL {url!r}: {error}") from error

    if parsed_url.scheme not in {"http", "https"}:
        raise ValueError(
            f"Unsupported URL scheme {parsed_url.scheme!r} in {url!r}. "
            "Only HTTP and HTTPS URLs are supported."
        )
    if parsed_url.hostname is None:
        raise ValueError(f"Invalid URL {url!r}: no host supplied.")

View on GitHub (pinned to 7f254d9784)

Solutions

1. Use proper URL syntax: forward slashes and a normal host ('https://host/path').
2. Convert Windows paths with `pathlib.PureWindowsPath(...).as_posix()` before embedding, and never in the authority.
3. For local files, use the local-path API rather than a URL.

Example fix

# before
url = 'http:\\server\share\image.jpg'
# after
url = 'https://server/share/image.jpg'

from urllib.parse import urlparse
assert '\\' not in urlparse(url).netloc, 'backslash in URL authority'

def url_authority_clean(url: str) -> bool:
    return '\\' not in urlparse(url).netloc

When it happens

Trigger: Passing a Windows path with forward scheme: `'http:\\server\share\file'`; mixed-separator URLs like 'https://host\path'; malicious input where `\` attempts to smuggle a different origin past the validator.

Common situations: Users pasting Windows UNC/network paths into a URL field; scripts building URLs from `os.path.join` on Windows; security testing payloads.

Related errors

• Unsupported URL scheme {parsed_url.scheme} in {url}. Only HT
• Invalid URL {url}: no host supplied.
• prepared URL is empty
• Invalid URL {url}: {error}
• module {__name__} has no attribute {name}

AI-assisted analysis of roboflow/supervision@7f254d9784 (2026-08-15). Data as JSON: /api/errors/70379834afd60ede. Report an issue: GitHub.