{"record":{"id":"553d050926e711b1","repo":"projectdiscovery/nuclei","slug":"invalid-ticketrequest-w","errorCode":null,"errorMessage":"invalid TicketRequest: %w","messagePattern":"invalid TicketRequest: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/krbforge/krbforge.go","lineNumber":242,"sourceCode":"\t\tnormalized = filepath.Join(config.DefaultConfig.GetTemplateDir(), normalized)\n\t}\n\n\tnormalized, err := filepath.Abs(normalized)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"normalize output file %q: %w\", outputFile, err)\n\t}\n\n\tif filepathutil.IsPathWithinDirectory(normalized, config.DefaultConfig.GetTemplateDir()) {\n\t\treturn normalized, nil\n\t}\n\n\treturn \"\", fmt.Errorf(\"path %v is outside nuclei-template directory and -allow-local-file-access is not enabled\", outputFile)\n}\n\nfunc exportTicketRequest(vm *goja.Runtime, value goja.Value) (TicketRequest, error) {\n\tvar req TicketRequest\n\tif err := vm.ExportTo(value, &req); err != nil {\n\t\treturn req, fmt.Errorf(\"invalid TicketRequest: %w\", err)\n\t}\n\treturn req, nil\n}\n\nfunc exportOutputFile(value goja.Value) (string, error) {\n\tif goja.IsUndefined(value) || goja.IsNull(value) {\n\t\treturn \"\", nil\n\t}\n\toutputFile, ok := value.Export().(string)\n\tif !ok {\n\t\treturn \"\", fmt.Errorf(\"outputFile must be a string\")\n\t}\n\treturn outputFile, nil\n}\n","sourceCodeStart":224,"sourceCodeEnd":257,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/krbforge/krbforge.go#L224-L257","documentation":"Thrown by exportTicketRequest in krbforge when goja's vm.ExportTo cannot convert the first argument of CreateGoldenTicket/CreateSilverTicket into the TicketRequest struct. ExportTo fails when the value is not a plain object (string, number, array, null-as-argument) or when a field has an incompatible type, e.g. user_id supplied as string '1010' instead of number 1010.","triggerScenarios":"krb.CreateGoldenTicket('admin') or passing an array/JSON string; krab.CreateSilverTicket({user_id: '500', ...}) where the struct expects uint32; nested wrong types such as groups: '512' instead of groups: [512].","commonSituations":"Building the request from a template extractor/variable that yields strings and forgetting to cast to numbers; passing JSON.parse output of a differently-shaped object; typos are NOT caught here (unknown keys are ignored, they fail later as empty required fields).","solutions":["Pass a plain object literal whose keys match the documented field names (Username, Domain, DomainSID, NTHash, AESKey, SPN, UserID, PrimaryGroupID, Groups, ExtraSIDs, DurationHours, KVNO, OutputFile)","Cast numeric fields with Number(...) before the call: user_id: Number(userIdVar)","Ensure array fields are real arrays of the right element type (Groups: [512, 513])","If the request came from JSON.parse, validate its shape against the expected schema first"],"exampleFix":"// before\nkrb.CreateGoldenTicket({\n  Username: 'Administrator',\n  Domain: 'acme.local',\n  DomainSID: 'S-1-5-21-...',\n  UserID: templateVar, // string like '500' -> ExportTo fails\n});\n\n// after\nkrb.CreateGoldenTicket({\n  Username: 'Administrator',\n  Domain: 'acme.local',\n  DomainSID: 'S-1-5-21-...',\n  UserID: Number(templateVar),\n});","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"function isTicketRequest(v) {\n  if (typeof v !== 'object' || v === null || Array.isArray(v)) return false;\n  for (const k of ['Username','Domain','DomainSID','NTHash','AESKey','SPN','OutputFile']) {\n    if (k in v && typeof v[k] !== 'string') return false;\n  }\n  for (const k of ['UserID','PrimaryGroupID','DurationHours','KVNO']) {\n    if (k in v && typeof v[k] !== 'number') return false;\n  }\n  if ('Groups' in v && !Array.isArray(v.Groups)) return false;\n  return true;\n}\nif (!isTicketRequest(req)) throw new Error('bad ticket request shape');","tryCatchPattern":"try {\n  krb.CreateGoldenTicket(req);\n} catch (e) {\n  if (String(e).includes('invalid TicketRequest')) {\n    // log the offending object shape for template debugging\n    log('TicketRequest rejected: ' + to_json(req));\n  }\n}","preventionTips":["Always pass an object literal, never a stringified JSON or positional args","Cast numeric fields (UserID, PrimaryGroupID, DurationHours, KVNO, Groups) with Number() when sourced from extractors","Keep arrays as arrays: Groups: [512], not Groups: '512'"],"tags":["javascript","type-mismatch","krbforge","goja","validation","kerberos"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}