{"record":{"id":"0b05a5843d4c595e","repo":"kgretzky/evilginx2","slug":"js-inject-v","errorCode":null,"errorMessage":"js_inject: %v","messagePattern":"js_inject: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":997,"sourceCode":"\t\theader: header,\n\t}\n\n\treturn nil\n}\n\nfunc (p *Phishlet) addJsInject(trigger_domains []string, trigger_paths []string, trigger_params []string, script string) error {\n\tjs := JsInject{\n\t\tid: GenRandomToken(),\n\t}\n\tfor _, d := range trigger_domains {\n\t\tjs.trigger_domains = append(js.trigger_domains, strings.ToLower(d))\n\t}\n\tfor _, d := range trigger_paths {\n\t\tre, err := regexp.Compile(\"^\" + d + \"$\")\n\t\tif err == nil {\n\t\t\tjs.trigger_paths = append(js.trigger_paths, re)\n\t\t} else {\n\t\t\treturn fmt.Errorf(\"js_inject: %v\", err)\n\t\t}\n\t}\n\tfor _, d := range trigger_params {\n\t\tjs.trigger_params = append(js.trigger_params, strings.ToLower(d))\n\t}\n\tjs.script = script\n\n\tp.js_inject = append(p.js_inject, js)\n\treturn nil\n}\n\nfunc (p *Phishlet) addIntercept(domain string, path *regexp.Regexp, http_status int, body string, mime string) error {\n\tic := Intercept{\n\t\tdomain:      strings.ToLower(domain),\n\t\tpath:        path,\n\t\thttp_status: http_status,\n\t\tbody:        body,\n\t\tmime:        mime,","sourceCodeStart":979,"sourceCodeEnd":1015,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L979-L1015","documentation":"During js_inject registration (adding a new injection entry to the phishlet), each entry's `trigger_paths` values are compiled as regexps wrapped with ^...$. If regexp.Compile fails for any trigger path, the error is wrapped as `js_inject: %v` and registration aborts. This guarantees only valid trigger path regexps are stored on the injection entry.","triggerScenarios":"Adding a js_inject block whose `trigger_paths` contain an invalid regular expression (e.g. unbalanced parenthesis, stray `*`, or an unterminated character class); the AddJsInject/registration path returns the wrapped compile error.","commonSituations":"Phishlet authors hand-writing regexps in YAML and making syntax mistakes; paths containing regex metacharacters like `?` or `+` that were meant literally but not escaped; copied regexps truncated during paste.","solutions":["Fix the regexp syntax in the js_inject `trigger_paths` entry reported in the wrapped error message","Escape literal regex metacharacters (e.g. use \\. for dots, \\? for question marks)","Test the regexp with a validator (regexp.Compile in Go or an online tester) before adding it to the phishlet"],"exampleFix":"# before\njs_inject:\n  - trigger_paths:\n      - '/account(/detail)?*'\n# after\njs_inject:\n  - trigger_paths:\n      - '/account(/detail)?'","handlingStrategy":"validation","validationCode":"for _, d := range triggerPaths {\n    if _, err := regexp.Compile(\"^\" + d + \"$\"); err != nil {\n        return fmt.Errorf(\"invalid trigger_paths regexp %q: %v\", d, err)\n    }\n}","typeGuard":"func isValidTriggerPath(d string) bool {\n    _, err := regexp.Compile(\"^\" + d + \"$\")\n    return err == nil\n}","tryCatchPattern":"err := ph.AddJsInject(domains, triggerPaths, triggerParams, script)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"js_inject:\") {\n        log.Fatal(\"bad trigger_paths regexp in js_inject: %v\", err)\n    }\n    return err\n}","preventionTips":["Escape regex metacharacters in literal paths (?, +, *, .)","Test every trigger path regexp before committing the phishlet","Keep trigger_paths simple; prefer exact paths over complex patterns","Read the wrapped `js_inject: %v` message - it contains the raw regexp error"],"tags":["phishlet","js-inject","regexp"],"backgroundTag":"invalid-regexp","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}