{"record":{"id":"0b387101d82dd19f","repo":"shadow1ng/fscan","slug":"webscan-expression-eval-failed","errorCode":"webscan_expression_eval_failed","errorMessage":"webscan_expression_eval_failed: %w","messagePattern":"webscan_expression_eval_failed: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"webscan/lib/Eval.go","lineNumber":184,"sourceCode":"\t\tast, issues := env.Compile(expression)\n\t\tif issues.Err() != nil {\n\t\t\treturn nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"webscan_expression_compile_failed\"), issues.Err())\n\t\t}\n\n\t\tvar err error\n\t\tprogram, err = env.Program(ast, GetBaseProgramOptions()...)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"webscan_program_create_failed\"), err)\n\t\t}\n\n\t\tif cache != nil {\n\t\t\tcache[expression] = program\n\t\t}\n\t}\n\n\tresult, _, err := program.Eval(params)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"webscan_expression_eval_failed\"), err)\n\t}\n\n\treturn result, nil\n}\n\n// URLTypeToString 将 TargetURL 结构体转换为字符串\nfunc URLTypeToString(u *UrlType) string {\n\tvar builder strings.Builder\n\n\t// 处理 scheme 部分\n\tif u.Scheme != \"\" {\n\t\tbuilder.WriteString(u.Scheme)\n\t\tbuilder.WriteByte(':')\n\t}\n\n\t// 处理 host 部分\n\tif u.Scheme != \"\" || u.Host != \"\" {\n\t\tif u.Host != \"\" || u.Path != \"\" {","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/webscan/lib/Eval.go#L166-L202","documentation":"The compiled CEL program was created but program.Eval(params) returned a runtime error, wrapped as webscan_expression_eval_failed. Compilation succeeded, so this is a runtime problem: missing params keys, type errors during evaluation, nil dereference on map fields, or a custom function panicking/returning an error.","triggerScenarios":"Evaluate/EvaluateCached with params lacking a variable the expression references, indexing a missing key on a map-typed param (e.g. response.headers missing), comparing incompatible runtime types, calling a custom function with wrong argument types.","commonSituations":"Expressions referencing response.body when the response had no body, header lookups on missing headers, string-to-int comparisons, running a POC against a target where an expected field is absent (e.g. no Server header).","solutions":["Read the wrapped err — cel-go names the failing operation/variable","Provide all declared variables in params before evaluation","Make POC expressions defensive: use has() / 'key' in map checks before indexing","Verify custom function argument types match what the expression passes"],"exampleFix":"// before (indexes missing header, runtime error)\n\"response.headers['Server'] contains 'Tomcat'\"\n// after (guard with membership test)\n\"('Server' in response.headers) && response.headers['Server'].contains('Tomcat')\"","handlingStrategy":"try-catch","validationCode":"for _, key := range requiredVars(expr) {\n    if _, ok := params[key]; !ok {\n        return fmt.Errorf(\"missing param %q for expression\", key)\n    }\n}","typeGuard":null,"tryCatchPattern":"result, err := Evaluate(expr, params)\nif err != nil {\n    log.Printf(\"eval failed for %q: %v\", expr, err)\n    return nil // treat expression failure as \"poc not matched\"\n}","preventionTips":["Write defensive expressions: guard map indexing with 'key' in map","Always pass the full declared variable set in params","Treat per-POC eval errors as non-fatal and continue the scan"],"tags":["go","cel","runtime","evaluation","webscan"],"backgroundTag":"unexpected-api-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}