{"record":{"id":"818f78591fb1c900","repo":"kgretzky/evilginx2","slug":"js-inject-missing-trigger-paths-field","errorCode":null,"errorMessage":"js_inject: missing `trigger_paths` field","messagePattern":"js_inject: missing `trigger_paths` field","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":472,"sourceCode":"\t\t\t\treturn fmt.Errorf(\"sub_filters: missing `replace` field\")\n\t\t\t}\n\t\t\tif sf.WithParams == nil {\n\t\t\t\tsf.WithParams = &[]string{}\n\t\t\t}\n\n\t\t\tfor n := range *sf.Mimes {\n\t\t\t\t(*sf.Mimes)[n] = p.paramVal((*sf.Mimes)[n])\n\t\t\t}\n\t\t\tp.addSubFilter(p.paramVal(*sf.Hostname), p.paramVal(*sf.Sub), p.paramVal(*sf.Domain), *sf.Mimes, p.paramVal(*sf.Search), p.paramVal(*sf.Replace), sf.RedirectOnly, *sf.WithParams)\n\t\t}\n\t}\n\tif fp.JsInject != nil {\n\t\tfor _, js := range *fp.JsInject {\n\t\t\tif js.TriggerDomains == nil {\n\t\t\t\treturn fmt.Errorf(\"js_inject: missing `trigger_domains` field\")\n\t\t\t}\n\t\t\tif js.TriggerPaths == nil {\n\t\t\t\treturn fmt.Errorf(\"js_inject: missing `trigger_paths` field\")\n\t\t\t}\n\t\t\tif js.Script == nil {\n\t\t\t\treturn fmt.Errorf(\"js_inject: missing `script` field\")\n\t\t\t}\n\t\t\tfor n := range *js.TriggerDomains {\n\t\t\t\t(*js.TriggerDomains)[n] = p.paramVal((*js.TriggerDomains)[n])\n\t\t\t}\n\t\t\tfor n := range *js.TriggerPaths {\n\t\t\t\t(*js.TriggerPaths)[n] = p.paramVal((*js.TriggerPaths)[n])\n\t\t\t}\n\t\t\terr := p.addJsInject(*js.TriggerDomains, *js.TriggerPaths, js.TriggerParams, p.paramVal(*js.Script))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\tif fp.Intercept != nil {\n\t\tfor _, ic := range *fp.Intercept {","sourceCodeStart":454,"sourceCodeEnd":490,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L454-L490","documentation":"Each `js_inject` entry must define `trigger_paths`, the URL paths on which the script is injected. The entry's `trigger_paths` field was nil, so validation aborts. An empty-string path list entry can be used to match all paths, but the field itself must be present.","triggerScenarios":"A `js_inject:` entry lacks the `trigger_paths:` key; core/phishlet.go's `if js.TriggerPaths == nil` check fires after trigger_domains passes.","commonSituations":"Assuming the script injects everywhere when trigger_paths is omitted (it does not — the key is required); YAML indentation dropping the key; copying a block from an older phishlet schema.","solutions":["Add `trigger_paths: ['<path>']` (e.g. `trigger_paths: ['/login']` or `['.*']` to match all) to the entry","Keep it a YAML list; the code later ranges over *js.TriggerPaths applying param substitution","Reload and fix any next missing field (script)"],"exampleFix":"// before\njs_inject:\n  - trigger_domains: ['auth.example.com']\n    script: 'alert(1)'\n// after\njs_inject:\n  - trigger_domains: ['auth.example.com']\n    trigger_paths: ['/login']\n    script: 'alert(1)'","handlingStrategy":"validation","validationCode":"for i, js in enumerate(cfg.get('js_inject') or []):\n    tp = js.get('trigger_paths')\n    if not isinstance(tp, list) or len(tp) == 0:\n        raise ValueError(f\"js_inject[{i}]: missing `trigger_paths` field\")","typeGuard":"func validJsInject(js JsInject) bool { return js.TriggerPaths != nil }","tryCatchPattern":null,"preventionTips":["Always specify trigger_paths explicitly; use a catch-all path entry if you want all paths","Keep the list form even for a single path","Differ from trigger_domains: paths match URL path prefixes"],"tags":["phishlet","config-validation","js-inject","missing-field"],"backgroundTag":"missing-required-config-field","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}