`unexpected fragment in flake reference` error when trying to use a git branch with a `#` in the name as a flake input

[nothingnesses]

Describe the bug

The unexpected fragment in flake reference error is displayed when building a flake that has a git input with a # in the name.

Steps To Reproduce

1. Clone this repository.
2. In the newly cloned repository, run nix build.

Expected behavior

The project builds.

Metadata

nix-env (Nix) 2.24.14

Additional context

Checklist

• checked latest Nix manual (source)
• checked open bug issues and pull requests for possible duplicates

---

Add 👍 to issues you find important.

[cole-h]

What if you URL-escape it by doing %23 in place of the # character?

[nothingnesses]

@cole-h I get this error instead:

error: in URL 'github:nothingnesses/flake-pound-issue/its/a%23branch', 'its/a#branch' is not a branch/tag name

[roberth]

Discussed in Nix meeting today:

URL escaping should be the solution.
We should probably get rid of

nix/src/libutil/include/nix/util/url-parts.hh

Line 36 in d46ce52

const static std::string badGitRefRegexS = "//|^[./]|/\\.|\\.\\.|[[:cntrl:][:space:]:?^~\[]|\\\\|\\*|\\.lock$|\\.lock/|@\\{|[/.]$|^@$|^$";

or replace it with an accurate regex, if at all possible.

Since we use libgit2, we're somewhat less susceptible to git ref syntax injection attacks (not sure about the vector).
With that in mind, it might be ok to just leave the checking to libgit2 instead.

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/2025-06-11-nix-team-meeting-minutes-231/65543/1