{"record":{"id":"233509604e2e4bd2","repo":"kgretzky/evilginx2","slug":"force-post-missing-or-empty-path-field","errorCode":null,"errorMessage":"force_post: missing or empty `path` field","messagePattern":"force_post: missing or empty `path` field","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":700,"sourceCode":"\t\t\t}\n\t\t\to.search, err = regexp.Compile(p.paramVal(*cp.Search))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\to.tp = cp.Type\n\t\t\tif o.tp == \"\" {\n\t\t\t\to.tp = \"post\"\n\t\t\t}\n\t\t\to.key_s = p.paramVal(*cp.Key)\n\t\t\tp.custom = append(p.custom, o)\n\t\t}\n\t}\n\n\tif fp.ForcePosts != nil {\n\t\tfor _, op := range *fp.ForcePosts {\n\t\t\tvar err error\n\t\t\tif op.Path == nil || *op.Path == \"\" {\n\t\t\t\treturn fmt.Errorf(\"force_post: missing or empty `path` field\")\n\t\t\t}\n\t\t\tif op.Type == nil || *op.Type != \"post\" {\n\t\t\t\treturn fmt.Errorf(\"force_post: unknown type - only 'post' is currently supported\")\n\t\t\t}\n\t\t\tif op.Force == nil || len(*op.Force) == 0 {\n\t\t\t\treturn fmt.Errorf(\"force_post: missing or empty `force` field\")\n\t\t\t}\n\n\t\t\tfpf := ForcePost{}\n\t\t\tfpf.path, err = regexp.Compile(p.paramVal(*op.Path))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tfpf.tp = *op.Type\n\n\t\t\tif op.Search != nil {\n\t\t\t\tfor _, op_s := range *op.Search {\n\t\t\t\t\tif op_s.Key == nil {","sourceCodeStart":682,"sourceCodeEnd":718,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L682-L718","documentation":"This error is thrown during phishlet validation when a `force_post` operation entry lacks the `path` field entirely or has an empty string as its value. The phishlet parser requires each force_post operation to specify the URL path it applies to; the `path` is later compiled into a regexp after parameter substitution. Since the field is a pointer (*string), nil means the key was absent from the YAML config, which makes the operation unmatchable.","triggerScenarios":"Calling phishlet validation/loading (e.g. p.Validate()) on a phishlet whose YAML contains a `force_post` list element without a `path` key, or with `path: ''`.","commonSituations":"Hand-edited phishlet files copied from older or broken examples; typos like `paths:` instead of `path:`; YAML indentation mistakes that drop the key into a different mapping; refactoring a force_post block and accidentally deleting the path line.","solutions":["Add a non-empty `path` key to every force_post operation in the phishlet YAML","Fix YAML indentation so the `path` key is nested under the correct force_post list item","Correct key-name typos (e.g. `paths`/`url` -> `path`)","Run the phishlet through `phishlets edit <name>` or a YAML linter to spot structural mistakes"],"exampleFix":"# before\nforce_post:\n  - type: post\n    force:\n      - key: password\n        value: '123456'\n# after\nforce_post:\n  - path: '/login'\n    type: post\n    force:\n      - key: password\n        value: '123456'","handlingStrategy":"validation","validationCode":"for i, op := range forcePosts {\n    if op.Path == nil || strings.TrimSpace(*op.Path) == \"\" {\n        return fmt.Errorf(\"force_post[%d]: `path` is required and must be non-empty\", i)\n    }\n}","typeGuard":"func hasPath(op ForcePostOp) bool { return op.Path != nil && *op.Path != \"\" }","tryCatchPattern":null,"preventionTips":["Always include `path` in every force_post entry","Validate phishlet YAML with a linter before loading","Keep a canonical example phishlet and copy its force_post schema","Use `phishlets edit` instead of hand-editing raw files"],"tags":["phishlet","config-validation","force-post"],"backgroundTag":"phishlet-config-validation","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}