Skip to content

Z615: FORBIDDEN_URL_SCHEME

  • Severity: Error

    Penalty: 0.0 points | Category: general

  • Remediation & Opt-In

    Auto-Fixable: No | Opt-In: No

Description

A link uses a URL scheme protocol that is not permitted by the explicit whitelist declared in [policies].required_url_schemes.

The Policy-as-Code Engine enables project maintainers to enforce protocol security across documentation links. For example, requiring https and mailto blocks unencrypted http:// links.

Z615 is a warning severity finding (Penalty: 3.0 pts). Note: This rule is distinct from Z205 (Forbidden href scheme like javascript: or data:), which is a non-suppressible security violation.

How to Fix

Update the link protocol to use an approved scheme from required_url_schemes:

Before (non-compliant when required_url_schemes = ["https", "mailto"]):

Check out [our site](http://example.com/docs).

After (compliant):

Check out [our site](https://example.com/docs).

Configuration

Z615 is opt-in and inactive by default. It is enabled by populating required_url_schemes under [policies] in .zenzic.toml:

[policies]
required_url_schemes = [
    "https",
    "mailto",
]

When required_url_schemes is empty or absent, no Z615 findings are emitted.

Suppression

If a non-standard URL scheme is required in a specific document, suppress the finding inline:

<!-- zenzic:ignore:Z615 -->
[FTP Mirror](ftp://archive.example.org/files)

Or use [governance].per_file_ignores in .zenzic.toml:

[governance.per_file_ignores]
"docs/legacy/**" = ["Z615"]

Reference

See the Finding Codes Index for finding code details.