{"record":{"id":"658f43a0a80e2363","repo":"kgretzky/evilginx2","slug":"sub-filters-missing-orig-sub-field","errorCode":null,"errorMessage":"sub_filters: missing `orig_sub` field","messagePattern":"sub_filters: missing `orig_sub` field","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":442,"sourceCode":"\t}\n\tlanding_set := false\n\tfor _, ph := range p.proxyHosts {\n\t\tif ph.is_landing {\n\t\t\tlanding_set = true\n\t\t\tbreak\n\t\t}\n\t}\n\tif !landing_set {\n\t\tp.proxyHosts[0].is_landing = true\n\t}\n\n\tif fp.SubFilters != nil {\n\t\tfor _, sf := range *fp.SubFilters {\n\t\t\tif sf.Hostname == nil {\n\t\t\t\treturn fmt.Errorf(\"sub_filters: missing `triggers_on` field\")\n\t\t\t}\n\t\t\tif sf.Sub == nil {\n\t\t\t\treturn fmt.Errorf(\"sub_filters: missing `orig_sub` field\")\n\t\t\t}\n\t\t\tif sf.Domain == nil {\n\t\t\t\treturn fmt.Errorf(\"sub_filters: missing `domain` field\")\n\t\t\t}\n\t\t\tif sf.Mimes == nil {\n\t\t\t\treturn fmt.Errorf(\"sub_filters: missing `mimes` field\")\n\t\t\t}\n\t\t\tif sf.Search == nil {\n\t\t\t\treturn fmt.Errorf(\"sub_filters: missing `search` field\")\n\t\t\t}\n\t\t\tif sf.Replace == nil {\n\t\t\t\treturn fmt.Errorf(\"sub_filters: missing `replace` field\")\n\t\t\t}\n\t\t\tif sf.WithParams == nil {\n\t\t\t\tsf.WithParams = &[]string{}\n\t\t\t}\n\n\t\t\tfor n := range *sf.Mimes {","sourceCodeStart":424,"sourceCodeEnd":460,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L424-L460","documentation":"Thrown when a `sub_filters` entry passes the hostname (triggers_on) check but lacks the `orig_sub` field. `orig_sub` is the subdomain of the target site whose responses should be searched and rewritten; combined with domain it selects which upstream responses the filter applies to. Missing it leaves the filter untargetable, so validation fails.","triggerScenarios":"A sub_filters entry defines `triggers_on`, `domain`, `search`, `replace` but omits `orig_sub:` (or it is misspelled/mis-indented so sf.Sub stays nil).","commonSituations":"Writing filters with only search/replace pairs copied from CSS-selector style tools; typo `orig-domain`; deleted line while trimming unneeded filters.","solutions":["Add `orig_sub:` to each sub_filters entry","Set it to the subdomain on the target that the filter should apply to (use `''` for the bare domain)","Verify all six fields (triggers_on, orig_sub, domain, search, replace, and optional mimes) are siblings under the same list item"],"exampleFix":"// before\nsub_filters:\n  - triggers_on: 'accounts.example.com'\n    domain: example.com\n    search: 'href=\"logout\"'\n    replace: '#'\n// after\nsub_filters:\n  - triggers_on: 'accounts.example.com'\n    orig_sub: accounts\n    domain: example.com\n    search: 'href=\"logout\"'\n    replace: '#'\n","handlingStrategy":"validation","validationCode":"type subFilter struct {\n\tHostname *string `yaml:\"triggers_on\"`\n\tSub      *string `yaml:\"orig_sub\"`\n\tDomain   *string `yaml:\"domain\"`\n}\nvar fp struct { SubFilters *[]subFilter `yaml:\"sub_filters\"` }\nyaml.Unmarshal(data, &fp)\nfor i, sf := range *fp.SubFilters {\n\tif sf.Sub == nil {\n\t\treturn fmt.Errorf(\"sub_filters[%d]: missing orig_sub\", i)\n\t}\n}","typeGuard":"func hasOrigSub(sf SubFilter) bool {\n\treturn sf.Sub != nil\n}","tryCatchPattern":"err := cfg.AddPhishlet(\"local\", name)\nif err != nil {\n\tif strings.Contains(err.Error(), \"sub_filters: missing `orig_sub`\") {\n\t\tlog.Fatalf(\"phishlet %s: each sub_filters entry needs orig_sub to target the upstream subdomain\", name)\n\t}\n\treturn err\n}","preventionTips":["Always include orig_sub in sub_filters, matching the proxied host's orig_sub","Use '' when the filter applies to the bare domain","Keep orig_sub at the same indent as triggers_on and domain","Validate each filter has all required fields before reloading the phishlet"],"tags":["phishlet","sub-filters","config-validation"],"backgroundTag":"phishlet-schema-validation","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}