{"record":{"id":"606228fe79690497","repo":"kgretzky/evilginx2","slug":"login-missing-path-field","errorCode":null,"errorMessage":"login: missing `path` field","messagePattern":"login: missing `path` field","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":639,"sourceCode":"\t\treturn fmt.Errorf(\"credentials: %v\", err)\n\t}\n\n\tp.username.tp = fp.Credentials.Username.Type\n\tif p.username.tp == \"\" {\n\t\tp.username.tp = \"post\"\n\t}\n\tp.password.tp = fp.Credentials.Password.Type\n\tif p.password.tp == \"\" {\n\t\tp.password.tp = \"post\"\n\t}\n\tp.username.key_s = p.paramVal(*fp.Credentials.Username.Key)\n\tp.password.key_s = p.paramVal(*fp.Credentials.Password.Key)\n\n\tif fp.LoginItem.Domain == nil {\n\t\treturn fmt.Errorf(\"login: missing `domain` field\")\n\t}\n\tif fp.LoginItem.Path == nil {\n\t\treturn fmt.Errorf(\"login: missing `path` field\")\n\t}\n\tp.login.domain = p.paramVal(*fp.LoginItem.Domain)\n\tif p.login.domain == \"\" {\n\t\treturn fmt.Errorf(\"login: `domain` field cannot be empty\")\n\t}\n\tlogin_domain_ok := false\n\tfor _, h := range p.proxyHosts {\n\t\tvar check_host string\n\t\tif h.orig_subdomain != \"\" {\n\t\t\tcheck_host = h.orig_subdomain + \".\"\n\t\t}\n\t\tcheck_host += h.domain\n\t\tif strings.ToLower(check_host) == strings.ToLower(p.login.domain) {\n\t\t\tlogin_domain_ok = true\n\t\t\tbreak\n\t\t}\n\t}\n\tif !login_domain_ok {","sourceCodeStart":621,"sourceCodeEnd":657,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L621-L657","documentation":"The `login` section of a phishlet must define a `path` field pointing at the URL path of the login page. When `login.path` is absent (nil), validation stops with this error before any path matching is configured.","triggerScenarios":"Loading a phishlet YAML where the `login:` mapping has `domain` but no `path` key (or neither, with domain checked first).","commonSituations":"Truncated phishlet files; authors assuming path is optional; migrating from formats where the login URL was derived differently.","solutions":["Add `path: /login` (the real login URL path of the target site) under the `login:` section.","Verify the path matches the actual form page; subfilters only trigger on matching paths.","Keep quoting in YAML if the path contains special characters.","Reload and address the next validation error if any."],"exampleFix":"// before\nlogin:\n  domain: accounts.example.com\n// after\nlogin:\n  domain: accounts.example.com\n  path: /signin","handlingStrategy":"validation","validationCode":"if pl.Login == nil || pl.Login.Path == nil || pl.Login.Path == \"\" {\n    return errors.New(\"phishlet: login.path is required (e.g. /login)\")\n}","typeGuard":"func loginPathSet(l *LoginItem) bool { return l != nil && l.Path != nil && *l.Path != \"\" }","tryCatchPattern":"if err := pl.Load(cfg); err != nil {\n    if strings.Contains(err.Error(), \"missing `path`\") {\n        log.Printf(\"add login.path to %s\", pl.Name)\n    }\n}","preventionTips":["Verify the target's real login URL and put its path in login.path.","Keep domain and path adjacent in the login block so one is not forgotten.","Schema-validate phishlet YAML files.","Re-load phishlets after every edit."],"tags":["configuration","phishlet","yaml","missing-field"],"backgroundTag":"missing-required-argument","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}