Report an empty required url as a missing field

[Hannah-PortSwigger]

The defect

The required-fields filter skips url whenever it is applicable, on the assumption that an unusable url has already been reported as a format error:

if (field === 'url' && urlValidated && !url) return false; // already reported as invalid format

But urlValidated is set from scope (config.applicableFields.includes('url')), not from outcome. An empty url reports nothing — both branches of the url validation are guarded on rawUrl being truthy and fall straight through. So a missing url is dropped from missingFields and never reported.

Where url is the only missing required field, errors ends up empty and the inputs pass sanitization with url set to '', leaving the caller to fail later on an empty value:

type	title	author	url	version	error_message today
extension-submission	✅	✅	(empty)	✅	""
extension-update	✅	✅	(empty)	✅	""
extension-submission	✅	(empty)	(empty)	(empty)	Missing required fields: author, version_number — url omitted

The fix

Track whether a url error was actually reported rather than whether url was in scope. This mirrors versionValidationFailed, added in ffefdd1 alongside the equivalent version_number guard — that one got the pattern right; the url guard predates it and never did.

urlValidated is replaced by urlValidationFailed, set at the two points that push a url error. No change to TYPE_CONFIG, URL_PATTERNS, or any requiredFields / applicableFields entry.

Behaviour

An empty required url is now reported. An invalid or over-length url still reports only its format message, with no duplicate Missing required fields entry — the double-reporting the original guard existed to prevent.

case	before	after
empty url, other fields valid	""	Missing required fields: url
invalid url format	Invalid ... URL format. Expected: ...	unchanged
url over 500 chars	URL exceeds maximum length of 500 characters	unchanged
all fields valid	""	unchanged

url is in requiredFields for all four types, so this applies to bcheck and bambda as well as the two extension types: an empty url stops passing through silently and is reported instead. Their configuration is untouched, but the outcome does change, so worth a look from anyone owning those flows. A downstream step was always going to fail on the empty url — this reports it at the point it can be explained.

Tests

Three jobs added. The first two fail on main (both currently return error_message: ""); the third guards the fix against over-reporting and passes either way.

• extension-submission: missing url produces error
• extension-update: missing url produces error
• extension-submission: invalid url is not also reported as missing

Note on the caller

PortSwigger/extension-portal no longer depends on this: its extract_issue_fields.py now validates the form's required fields before sanitize-inputs runs and takes precedence on the error message. This is a correctness fix in the shared action, not a fix that portal submissions are waiting on. The pin there is v1.0.4 and will need bumping once this is tagged.

🤖 Generated with Claude Code