yamadashy/repomix · error · RepomixError

Invalid repository URL. URL contains potentially dangerous p

Error message

Invalid repository URL. URL contains potentially dangerous parameters: ${redactUrl(url)}

What it means

validateGitUrl blocks URLs containing git options that enable command/option injection (--upload-pack, --receive-pack, --config, --exec) before any git command runs. This is a security guard, so the URL is rejected outright and redacted in the message.

Source

Thrown at src/core/git/gitCommand.ts:233

      maxCommits.toString(),
    ]);

    return result.stdout || '';
  } catch (error) {
    logger.trace('Failed to execute git log:', (error as Error).message);
    throw error;
  }
};

/**
 * Validates a Git URL for security and format
 * @throws {RepomixError} If the URL is invalid or contains potentially dangerous parameters
 */
export const validateGitUrl = (url: string): void => {
  // Block dangerous git parameters that could be used for command injection
  const dangerousParams = ['--upload-pack', '--receive-pack', '--config', '--exec'];
  if (dangerousParams.some((param) => url.includes(param))) {
    throw new RepomixError(`Invalid repository URL. URL contains potentially dangerous parameters: ${redactUrl(url)}`);
  }

  // Check if the URL starts with git@ or https://
  if (!(url.startsWith('git@') || url.startsWith('https://'))) {
    throw new RepomixError(`Invalid URL protocol for '${redactUrl(url)}'. URL must start with 'git@' or 'https://'`);
  }

  try {
    if (url.startsWith('https://')) {
      new URL(url);
    }
  } catch (error: unknown) {
    logger.trace('Invalid repository URL:', redactErrorMessage(error));
    throw new RepomixError(`Invalid repository URL. Please provide a valid URL: ${redactUrl(url)}`);
  }
};

/**

View on GitHub (pinned to f465ad9093)

Solutions

Remove any git CLI flags embedded in the URL string; pass only the repository URL.
Sanitize/validate user-supplied URLs before passing them to repomix's remote APIs.
Use a plain https:// or git@ URL, e.g. https://github.com/owner/repo.git.
If extra git options are genuinely needed, perform them manually with git rather than through repomix.

Example fix

// before
await cloneRepo('--upload-pack=my-script https://github.com/owner/repo')

// after
await cloneRepo('https://github.com/owner/repo')

Defensive patterns

Strategy: validation

Validate before calling

const dangerous = ['--upload-pack', '--receive-pack', '--config', '--exec'];
function assertSafeRemoteUrl(url: string): void {
  if (dangerous.some(p => url.includes(p))) {
    throw new Error(`Refusing unsafe repository URL: ${url}`);
  }
}

Type guard

const isSafeGitUrl = (url: string): boolean =>
  !['--upload-pack', '--receive-pack', '--config', '--exec'].some(p => url.includes(p));

Try / catch

try {
  await repomix.pack({ input: { remote: url } });
} catch (e) {
  if (e instanceof Error && e.message.includes('potentially dangerous parameters')) {
    console.error('Strip git CLI flags from the URL before passing it to --remote.');
  } else throw e;
}

Prevention

Never concatenate user input or git flags into repository URLs.
Sanitize untrusted remote inputs through a strict allowlist (host + owner/repo).
Pass only plain https:// or git@ URLs to --remote.
In CI, validate the remote URL parameter before invoking repomix.

When it happens

Trigger: Calling execLsRemote, execLsRemoteHead, or execGitShallowClone (e.g. via repomix --remote) with a repository URL whose string includes any of the dangerous parameters.

Common situations: Constructed URLs from untrusted input that accidentally embed query-like fragments, injection attempts against CI pipelines that pass user input as --remote targets, or copy-paste mistakes including extra git flags in the URL.

Related errors

AI-assisted analysis of yamadashy/repomix@f465ad9093 (2026-08-29). Data as JSON: /api/errors/7884265caa5092f4. Report an issue: GitHub.