{"record":{"id":"23218280b91f0b2d","repo":"projectdiscovery/nuclei","slug":"outputfile-must-be-a-string","errorCode":null,"errorMessage":"outputFile must be a string","messagePattern":"outputFile must be a string","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/krbforge/krbforge.go","lineNumber":253,"sourceCode":"\n\treturn \"\", fmt.Errorf(\"path %v is outside nuclei-template directory and -allow-local-file-access is not enabled\", outputFile)\n}\n\nfunc exportTicketRequest(vm *goja.Runtime, value goja.Value) (TicketRequest, error) {\n\tvar req TicketRequest\n\tif err := vm.ExportTo(value, &req); err != nil {\n\t\treturn req, fmt.Errorf(\"invalid TicketRequest: %w\", err)\n\t}\n\treturn req, nil\n}\n\nfunc exportOutputFile(value goja.Value) (string, error) {\n\tif goja.IsUndefined(value) || goja.IsNull(value) {\n\t\treturn \"\", nil\n\t}\n\toutputFile, ok := value.Export().(string)\n\tif !ok {\n\t\treturn \"\", fmt.Errorf(\"outputFile must be a string\")\n\t}\n\treturn outputFile, nil\n}\n","sourceCodeStart":235,"sourceCodeEnd":257,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/krbforge/krbforge.go#L235-L257","documentation":"Thrown by exportOutputFile in krbforge when the second argument to CreateSilverTicket is neither undefined/null nor a string. The helper explicitly accepts only an absent value or a string path; any other JS type (number, boolean, object, array) fails the value.Export().(string) assertion.","triggerScenarios":"krb.CreateSilverTicket(req, 42), krb.CreateSilverTicket(req, true), or passing an object like {path: '/tmp/x'} as the outputFile argument.","commonSituations":"Template logic that conditionally builds an options object and passes it as arg 2 by mistake; passing a port or timeout number in the wrong positional slot; copying a call signature from a different library that takes an options object.","solutions":["Pass a string path or omit the second argument entirely: krb.CreateSilverTicket(req) or krb.CreateSilverTicket(req, 'silver.ccache')","Pass undefined/null explicitly when no output file is wanted (both are accepted and treated as no file)","If the path is computed, coerce it: krb.CreateSilverTicket(req, String(pathVar))"],"exampleFix":"// before\nkrb.CreateSilverTicket(req, {path: '/tmp/silver.ccache'}); // object, not string\n\n// after\nkrb.CreateSilverTicket(req, '/tmp/silver.ccache');","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"// only string, undefined or null are accepted for outputFile\nconst okOutputFile = (v) => v === undefined || v === null || typeof v === 'string';\nif (!okOutputFile(secondArg)) throw new Error('outputFile must be a string path or omitted');","tryCatchPattern":"try {\n  krb.CreateSilverTicket(req, outputFile);\n} catch (e) {\n  if (String(e).includes('outputFile must be a string')) {\n    krb.CreateSilverTicket(req); // retry without file output\n  }\n}","preventionTips":["Omit the second argument unless you actually need a ccache file","Coerce computed paths with String() before passing","Never pass an options object in the outputFile slot"],"tags":["javascript","type-mismatch","krbforge","validation","kerberos"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}