usestrix/strix · error · ValueError

Invalid target: {target} Target must be one of: - A valid UR

Error message

Invalid target: {target}
Target must be one of:
- A valid URL (http:// or https://)
- A Git repository URL (https://host/org/repo or git@host:org/repo.git)
- A local directory path
- An API spec file (OpenAPI/Swagger .json/.yaml or a Postman collection)
- A Postman collection by id (postman://<collection-uid>[?env=<environment-uid>], needs POSTMAN_API_KEY)
- A domain name (e.g., example.com)
- An IP address (e.g., 192.168.1.10)

What it means

The final catch-all of infer_target_type: the string matched none of the recognized target shapes — no scheme, not an existing path, no '.git' suffix, no host/path split that looks like a repo URL, and no bare domain-like 'x.y' form. The long message enumerates every accepted target form, which doubles as the function's contract documentation.

Source

Thrown at strix/interface/utils.py:1195

        raise ValueError(f"Invalid path: {target} - {e!s}") from e

    if target.endswith(".git"):
        return "repository", {"target_repo": target}

    if "/" in target:
        host_part, _, path_part = target.partition("/")
        if "." in host_part and not host_part.startswith(".") and path_part:
            full_url = f"https://{target}"
            if _is_http_git_repo(full_url):
                return "repository", {"target_repo": full_url}
            return "web_application", {"target_url": full_url}

    if "." in target and "/" not in target and not target.startswith("."):
        parts = target.split(".")
        if len(parts) >= 2 and all(p and p.strip() for p in parts):
            return "web_application", {"target_url": f"https://{target}"}

    raise ValueError(
        f"Invalid target: {target}\n"
        "Target must be one of:\n"
        "- A valid URL (http:// or https://)\n"
        "- A Git repository URL (https://host/org/repo or git@host:org/repo.git)\n"
        "- A local directory path\n"
        "- An API spec file (OpenAPI/Swagger .json/.yaml or a Postman collection)\n"
        "- A Postman collection by id (postman://<collection-uid>[?env=<environment-uid>], "
        "needs POSTMAN_API_KEY)\n"
        "- A domain name (e.g., example.com)\n"
        "- An IP address (e.g., 192.168.1.10)"
    )


def read_target_list_file(path_str: str) -> list[str]:
    """Read scan targets from a file, one target per non-empty, non-comment line."""
    if not path_str or not path_str.strip():
        raise ValueError("--target-list path must not be empty.")

View on GitHub (pinned to 8551339130)

Solutions

Give the target a scheme: use http://localhost:8080 or https://example.com instead of bare hostnames with ports.
For IP:port or host:port forms, include the scheme, since the bare 'host/path' heuristic requires a dotted host and a '/' separator.
For local code, pass an existing directory path; for repos, use a full https:// or git@ URL or a path ending in .git.

Example fix

# before
strix -n -t localhost:8080

# after
strix -n -t http://localhost:8080

Defensive patterns

Strategy: validation

Validate before calling

from urllib.parse import urlparse

def looks_like_valid_target(t: str) -> bool:
    t = t.strip()
    if not t:
        return False
    p = urlparse(t)
    if p.scheme in ("http", "https", "git"):
        return bool(p.netloc)
    if t.startswith(("git@", "postman://")):
        return True
    from pathlib import Path
    return Path(t).expanduser().exists() or ("." in t.split("/")[0])

Try / catch

try:
    ttype, details = infer_target_type(target)
except ValueError as e:
    if str(e).startswith("Invalid target:"):
        raise SystemExit("Target not recognized. Add a scheme (http(s)://), use a git URL, an existing dir, or a domain.") from e
    raise

Prevention

Always include the scheme for URLs and host:port targets
Validate target strings in pipeline config before the scan step

When it happens

Trigger: Passing strings like 'my project', 'localhost' (no dot, no scheme), 'http://' (empty host), '..hidden/config', or single-label hostnames with no TLD and no slash; also targets whose existing-path check failed earlier in the chain.

Common situations: Quoting mistakes in shells that turn a URL into two words; using localhost:8080 without a scheme; trailing whitespace already stripped but internal spaces remain; expecting a hostname with port like '192.168.1.10:8080' to parse (it hits the host/path split with ':' not '.').

Related errors

AI-assisted analysis of usestrix/strix@8551339130 (2026-08-15). Data as JSON: /api/errors/9a9c9a1a1ab05bbc. Report an issue: GitHub.