{"record":{"id":"72b1137df8243304","repo":"projectdiscovery/nuclei","slug":"parse-target-w","errorCode":null,"errorMessage":"parse target: %w","messagePattern":"parse target: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/js/libs/goexec/target.go","lineNumber":18,"sourceCode":"package goexec\n\nimport (\n\t\"fmt\"\n\t\"net\"\n\t\"net/url\"\n\t\"strings\"\n)\n\nfunc normalizeTarget(target string) (string, error) {\n\ttarget = strings.TrimSpace(target)\n\tif target == \"\" {\n\t\treturn \"\", ErrMissingTarget\n\t}\n\tif strings.Contains(target, \"://\") {\n\t\tparsed, err := url.Parse(target)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"parse target: %w\", err)\n\t\t}\n\t\ttarget = parsed.Host\n\t}\n\tif host, port, err := net.SplitHostPort(target); err == nil {\n\t\tif host == \"\" {\n\t\t\treturn \"\", ErrMissingTarget\n\t\t}\n\t\tif port == \"\" {\n\t\t\treturn host, nil\n\t\t}\n\t\treturn net.JoinHostPort(host, port), nil\n\t}\n\tif strings.HasPrefix(target, \"[\") && strings.HasSuffix(target, \"]\") {\n\t\ttarget = strings.TrimPrefix(strings.TrimSuffix(target, \"]\"), \"[\")\n\t\tif target == \"\" {\n\t\t\treturn \"\", ErrMissingTarget\n\t\t}\n\t}","sourceCodeStart":1,"sourceCodeEnd":36,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/goexec/target.go#L1-L36","documentation":"normalizeTarget failed at url.Parse: the target contains '://' but is not a parseable URL. Go's url.Parse rejects control characters in URLs, invalid percent-escapes ('%zz'), and malformed hosts such as an unclosed IPv6 bracket. The target string handed to a goexec-backed client (wmi.Client, etc.) is malformed rather than a plain host or host:port.","triggerScenarios":"new wmi.Client('smb://dc01 acme/', auth) (space in authority), 'https://[2001:db8::1' (missing ']'), control bytes from untrusted input lists, or '%zz' escape sequences — anything with a scheme separator that fails strict URL parsing.","commonSituations":"Templates concatenating unvalidated input into the target; IPv6 literals copied without brackets closure; copy-paste targets with whitespace or CR.","solutions":["Pass a plain host or host:port ('dc01', '10.0.0.5:445') with no scheme.","Strip the scheme client-side: use new URL(target).host before constructing.","Trim whitespace and reject control characters in targets before use.","For IPv6, use bracketed host or host:port forms that net.SplitHostPort handles."],"exampleFix":"// before\nconst c = new wmi.Client('smb://dc01 acme/', auth); // parse target: invalid control character / missing parts\n\n// after\nconst raw = 'smb://dc01 acme/';\nconst host = new URL(raw.replace(/\\s+/g, '')).host || new URL(raw.replace(/\\s+/g, '')).hostname;\nconst c = new wmi.Client(host, auth);","handlingStrategy":"validation","validationCode":"// normalize the target client-side before constructing wmi.Client\nfunction toHostPort(target) {\n  let t = String(target || '').trim();\n  if (t.includes('://')) {\n    const u = new URL(t); // throws on malformed URLs — catch early\n    t = u.host || u.hostname;\n  }\n  if (/[\u0000-\u001f]/.test(t)) throw new Error('control characters in target');\n  return t; // plain host or host:port\n}\nconst safeTarget = toHostPort(rawTarget);","typeGuard":"/** @param {unknown} t @returns {boolean} */\nfunction isParsableTarget(t) {\n  if (typeof t !== 'string') return false;\n  const s = t.trim();\n  if (s === '' || /[\u0000-\u001f]/.test(s)) return false;\n  if (!s.includes('://')) return true;\n  try { new URL(s); return true; } catch (_) { return false; }\n}","tryCatchPattern":null,"preventionTips":["Pass plain host or host:port to goexec-backed clients; strip schemes yourself.","Trim whitespace and reject control characters when ingesting targets from files/input lists.","Close IPv6 brackets properly or omit them with a bare host."],"tags":["url-parsing","input-validation","target","ipv6","javascript"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}