{"record":{"id":"1688b2aff11b1564","repo":"projectdiscovery/nuclei","slug":"object-can-be-a-key-value-or-a-string","errorCode":null,"errorMessage":"object can be a key:value or a string","messagePattern":"object can be a key:value or a string","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/fuzz/type.go","lineNumber":80,"sourceCode":"\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tType: \"object\",\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t}\n\treturn gotType\n}\n\n// UnmarshalJSON implements json.Unmarshaler interface.\nfunc (v *SliceOrMapSlice) UnmarshalJSON(data []byte) error {\n\t// try to unmashal as a string and fallback to map\n\tif err := json.Unmarshal(data, &v.Value); err == nil {\n\t\treturn nil\n\t}\n\terr := json.Unmarshal(data, &v.KV)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"object can be a key:value or a string\")\n\t}\n\treturn nil\n}\n\n// MarshalJSON implements json.Marshaler interface.\nfunc (v SliceOrMapSlice) MarshalJSON() ([]byte, error) {\n\tif v.KV != nil {\n\t\treturn json.Marshal(v.KV)\n\t}\n\treturn json.Marshal(v.Value)\n}\n\n// UnmarshalYAML implements yaml.Unmarshaler interface.\nfunc (v *SliceOrMapSlice) UnmarshalYAML(callback func(interface{}) error) error {\n\t// try to unmarshal it as a string and fallback to map\n\tif err := callback(&v.Value); err == nil {\n\t\treturn nil\n\t}","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/fuzz/type.go#L62-L98","documentation":"SliceOrMapSlice (pkg/fuzz/type.go) backs the `fuzz:` payload field of fuzzing rules and accepts exactly two shapes: a flat array of strings or an object of string->string. UnmarshalJSON tries the array first, then the ordered map; if both fail (the JSON is a scalar, a nested array, an array of non-strings, or an object with non-string values), it returns this error and template/JSON parsing of the fuzz rule aborts.","triggerScenarios":"Supplying `\"fuzz\": 123` or `\"fuzz\": true` in JSON; an array with nested arrays or numbers like [[\"a\"]] or [1,2]; an object whose values are objects, arrays, or unquoted numbers; programmatically marshaling a struct into the fuzz field and hitting a shape mismatch.","commonSituations":"Hand-writing fuzz rules in JSON tools or UIs that infer types (numbers, booleans) instead of strings; pipelines that generate templates from typed data and forget to stringify payloads; porting YAML templates to JSON and keeping YAML-style nested structures.","solutions":["Use a flat array of quoted strings: \"fuzz\": [\"'\", \"admin\"]","Or an object where every key and value is a string: \"fuzz\": {\"user\": \"admin\"}","Quote numeric and boolean payloads so they marshal as JSON strings","Validate the template with `nuclei -validate` before running it"],"exampleFix":"// before\n\"fuzz\": {\n  \"user\": 123,\n  \"nested\": { \"a\": \"b\" }\n}\n\n// after\n\"fuzz\": {\n  \"user\": \"123\"\n}","handlingStrategy":"type-guard","validationCode":"var raw any\nif err := json.Unmarshal(data, &raw); err != nil {\n    return err\n}\nswitch v := raw.(type) {\ncase []any:\n    for _, it := range v {\n        if _, ok := it.(string); !ok {\n            return fmt.Errorf(\"fuzz payload array must contain only strings\")\n        }\n    }\ncase map[string]any:\n    for _, val := range v {\n        if _, ok := val.(string); !ok {\n            return fmt.Errorf(\"fuzz payload values must be strings\")\n        }\n    }\ndefault:\n    return fmt.Errorf(\"fuzz must be an array of strings or a string-to-string object\")\n}","typeGuard":"func isSliceOrMapSliceJSON(data []byte) bool {\n    var arr []string\n    if json.Unmarshal(data, &arr) == nil {\n        return true\n    }\n    var m map[string]string\n    return json.Unmarshal(data, &m) == nil\n}","tryCatchPattern":"if err := json.Unmarshal(data, &v); err != nil {\n    if strings.Contains(err.Error(), \"object can be a key:value or a string\") {\n        return fmt.Errorf(\"invalid fuzz payload shape in %s: use [\\\"str\\\",...] or {\\\"k\\\":\\\"v\\\"}\", path)\n    }\n    return err\n}","preventionTips":["Always stringify fuzz payloads (quote numbers/booleans)","Never nest arrays or objects inside the fuzz payload field","Run template validation after any JSON round-trip through typed tooling"],"tags":["json","fuzz","parsing","template","payloads"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}