{"record":{"id":"0002e250fe651677","repo":"ffuf/ffuf","slug":"u-flag-or-request-flag-is-required","errorCode":null,"errorMessage":"-u flag or -request flag is required","messagePattern":"-u flag or -request flag is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ffuf/optionsparser.go","lineNumber":239,"sourceCode":"\tout := make([]PreflightConfig, len(in))\n\tfor i, pf := range in {\n\t\tout[i] = pf\n\t\tout[i].Vars = append([]VarExtract(nil), pf.Vars...)\n\t}\n\treturn out\n}\n\n// ConfigFromOptions parses the values in ConfigOptions struct, ensures that the values are sane,\n// and creates a Config struct out of them.\nfunc ConfigFromOptions(parseOpts *ConfigOptions, ctx context.Context, cancel context.CancelFunc) (*Config, error) {\n\t//TODO: refactor in a proper flag library that can handle things like required flags\n\terrs := NewMultierror()\n\tconf := NewConfig(ctx, cancel)\n\n\tvar err error\n\tvar err2 error\n\tif len(parseOpts.HTTP.URL) == 0 && parseOpts.Input.Request == \"\" {\n\t\terrs.Add(fmt.Errorf(\"-u flag or -request flag is required\"))\n\t}\n\n\t// prepare extensions\n\tif parseOpts.Input.Extensions != \"\" {\n\t\textensions := strings.Split(parseOpts.Input.Extensions, \",\")\n\t\tconf.Extensions = extensions\n\t}\n\n\t// Effective request headers: the -H values plus any -b/-cookie folded in. Built\n\t// as a fresh slice so ConfigFromOptions never mutates the caller's options (it\n\t// stays idempotent) and the retained snapshot below shares no backing with it.\n\teffectiveHeaders := append([]string(nil), parseOpts.HTTP.Headers...)\n\tif len(parseOpts.HTTP.Cookies) > 0 {\n\t\teffectiveHeaders = append(effectiveHeaders, \"Cookie: \"+strings.Join(parseOpts.HTTP.Cookies, \"; \"))\n\t}\n\n\t//Prepare inputproviders\n\tconf.InputMode = parseOpts.Input.InputMode","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/ffuf/ffuf/blob/33c67d28c85b94589d029b3bcaff205a40cee9c4/pkg/ffuf/optionsparser.go#L221-L257","documentation":"ffuf requires a target: ConfigFromOptions validates that either the -u URL flag or a raw HTTP request via -request was supplied. If parseOpts.HTTP.URL is empty AND parseOpts.Input.Request is empty, the error is added to a Multierror and returned, so the run never starts. It is a pure CLI/config validation guard with no network involvement.","triggerScenarios":"Calling ffuf (or ConfigFromOptions) with no -u value, an empty -u '' argument, a config file lacking the URL key, and simultaneously no -request file/string, so both target sources are empty.","commonSituations":"Forgetting the -u flag entirely; a shell variable holding the target expanding to empty (e.g. -u $TARGET with TARGET unset); scripting ffuf where the URL is built dynamically and ends up blank; loading a saved config file that omits the url field.","solutions":["Pass the target with -u, e.g. -u https://example.com/FUZZ","Alternatively supply a raw HTTP request template with -request /path/to/request.txt","Check that any variable used in -u is actually set/non-empty in your shell","If using -config, add the url key to the JSON config file"],"exampleFix":"// before\nffuf -w words.txt -X GET\n// after\nffuf -w words.txt -u https://example.com/FUZZ","handlingStrategy":"validation","validationCode":"if opts.HTTP.URL == \"\" && opts.Input.Request == \"\" {\n    return fmt.Errorf(\"ffuf needs -u <url> or -request <file> before running\")\n}","typeGuard":"func hasTarget(url string, request string) bool {\n    return url != \"\" || request != \"\"\n}","tryCatchPattern":null,"preventionTips":["Always pass -u explicitly in scripts; never rely on unset shell variables","Check `$TARGET` is non-empty before interpolating into -u (set -u in bash)","Validate generated CLI args before exec'ing ffuf","When using -config files, assert the url key exists"],"tags":["cli","validation","configuration"],"backgroundTag":"missing-required-argument","analyzedSha":"33c67d28c85b94589d029b3bcaff205a40cee9c4","analyzedAt":"2026-09-04T18:24:34.068Z","contentChangedAt":"2026-09-04T18:24:34.068Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}