{"record":{"id":"5a7741d331d87f51","repo":"google/tsunami-security-scanner","slug":"no-valid-payload-input-is-entered","errorCode":null,"errorMessage":"No valid payload input is entered.","messagePattern":"No valid payload input is entered\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"plugin_server/py/plugin/payload/payload_generator.py","lineNumber":175,"sourceCode":"      payload: pg.PayloadDefinition,\n      config: pg.PayloadGeneratorConfig,\n      use_callback: bool,\n  ) -> bool:\n    return (\n        config.vulnerability_type in payload.vulnerability_type\n        and config.interpretation_environment\n        == payload.interpretation_environment\n        and config.execution_environment == payload.execution_environment\n        and bool(payload.uses_callback_server.ByteSize()) == use_callback\n    )\n\n\ndef _is_executed(regex: str) -> Callable[[Any, Optional[bytes]], bool]:\n  \"\"\"Check if the returned payload is executed by validating against the regex.\"\"\"\n\n  def check_payload_execution(_, data: Optional[bytes]) -> bool:\n    if data is None:\n      raise ValueError('No valid payload input is entered.')\n    string = data.decode('utf-8')\n    return bool(re.compile(regex).search(string)) or False\n\n  return check_payload_execution\n","sourceCodeStart":157,"sourceCodeEnd":180,"githubUrl":"https://github.com/google/tsunami-security-scanner/blob/363ba87b3543f8ae8e4304d3416818f03da7f262/plugin_server/py/plugin/payload/payload_generator.py#L157-L180","documentation":"The is_executed validator returned by _is_executed decodes the response data and checks it against the payload's regex. If the caller passes data=None (no response body to validate), ValueError('No valid payload input is entered.') is raised because execution cannot be assessed without data.","triggerScenarios":"Invoking the returned check_payload_execution callback with None as data, typically when a response body was empty/absent or the caller forwards an Optional bytes without a None check.","commonSituations":"A request returned no body (204, HEAD, connection error path) and the result was passed straight into the validator; plugin code that treats 'no response' and 'payload not executed' as the same case but the validator treats None as caller error.","solutions":["Check data is not None before calling the validator; treat None as not-executed or as a request-level failure","Handle empty bodies upstream and skip execution validation for them","Catch ValueError from the validator and map it to a 'payload not observed' outcome","Ensure the request actually retrieves a body (use GET/POST with response reading) before validating"],"exampleFix":"// before\nexecuted = is_executed(regex)(response, response_body)  # body may be None\n// after\nexecuted = response_body is not None and is_executed(regex)(response, response_body)","handlingStrategy":"type-guard","validationCode":"def safe_is_executed(validator, data):\n    if data is None:\n        return False\n    return validator(data)","typeGuard":"def has_response_body(data) -> bool:\n    return data is not None and len(data) > 0","tryCatchPattern":"try:\n    executed = check_payload_execution(response, data)\nexcept ValueError:\n    executed = False  # no data means payload could not be observed","preventionTips":["Never forward Optional response bodies into validators without a None check","Classify empty/absent response bodies as a separate outcome from not-executed","Log raw response status and body length when payload validation is skipped"],"tags":["python","payload","validation","null-check"],"backgroundTag":"null-argument","analyzedSha":"363ba87b3543f8ae8e4304d3416818f03da7f262","analyzedAt":"2026-09-13T01:50:53.990Z","contentChangedAt":"2026-09-13T01:50:53.990Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}