{"record":{"id":"2b7ab5b0de32d07a","repo":"ffuf/ffuf","slug":"malformed-request-supplied","errorCode":null,"errorMessage":"malformed request supplied","messagePattern":"malformed request supplied","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ffuf/optionsparser.go","lineNumber":746,"sourceCode":"\nfunc parseRawRequest(parseOpts *ConfigOptions, conf *Config) error {\n\tconf.RequestFile = parseOpts.Input.Request\n\tconf.RequestProto = parseOpts.Input.RequestProto\n\tfile, err := os.Open(parseOpts.Input.Request)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not open request file: %s\", err)\n\t}\n\tdefer file.Close()\n\n\tr := bufio.NewReader(file)\n\n\ts, err := r.ReadString('\\n')\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not read request: %s\", err)\n\t}\n\tparts := strings.Split(s, \" \")\n\tif len(parts) < 3 {\n\t\treturn fmt.Errorf(\"malformed request supplied\")\n\t}\n\t// Set the request Method\n\tconf.Method = parts[0]\n\n\tfor {\n\t\tline, err := r.ReadString('\\n')\n\t\tline = strings.TrimSpace(line)\n\n\t\tif err != nil || line == \"\" {\n\t\t\tbreak\n\t\t}\n\n\t\tp := strings.SplitN(line, \":\", 2)\n\t\tif len(p) != 2 {\n\t\t\tcontinue\n\t\t}\n\n\t\tif strings.EqualFold(p[0], \"content-length\") {","sourceCodeStart":728,"sourceCodeEnd":764,"githubUrl":"https://github.com/ffuf/ffuf/blob/33c67d28c85b94589d029b3bcaff205a40cee9c4/pkg/ffuf/optionsparser.go#L728-L764","documentation":"The first line of a raw HTTP request must contain at least three space-separated tokens: METHOD, PATH, and PROTOCOL (e.g. 'GET /dir/FUZZ HTTP/1.1'). parseRawRequest splits the request line on spaces and returns this error if fewer than 3 parts result, because it cannot determine the method and target.","triggerScenarios":"ConfigFromOptions -> parseRawRequest when the request line has fewer than 3 space-separated parts — e.g. 'GET /path' (missing HTTP version), a stray 'GET' alone, or a line of garbage that happens to read successfully.","commonSituations":"Hand-edited request files that dropped the HTTP version token; HTTP/2-style pseudo request lines ('GET /path' without version); files saved with only headers; copy-paste losing the protocol suffix due to line wrapping.","solutions":["Make the first line a full request line: 'METHOD /path HTTP/1.1'","Re-export the raw request from the proxy tool instead of hand-editing","Check for lost characters from copy-paste (the HTTP/1.1 suffix)","Verify no encoding issue collapsed the spaces in the line"],"exampleFix":"// before (req.txt first line)\nGET /dir/FUZZ\n// after\nGET /dir/FUZZ HTTP/1.1\nHost: example.com\n\n","handlingStrategy":"validation","validationCode":"f, _ := os.Open(opts.Input.Request)\nfirst, _ := bufio.NewReader(f).ReadString('\\n')\nf.Close()\nif len(strings.Fields(first)) < 3 {\n    return fmt.Errorf(\"request line %q must be 'METHOD /path HTTP/1.1'\", strings.TrimSpace(first))\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always include the HTTP version token in the request line","Avoid manual edits that drop tokens from the first line","Validate request files with a quick three-token check before scans"],"tags":["http","request-file","parsing"],"backgroundTag":"malformed-request-file","analyzedSha":"33c67d28c85b94589d029b3bcaff205a40cee9c4","analyzedAt":"2026-09-04T18:24:34.068Z","contentChangedAt":"2026-09-04T18:24:34.068Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}