{"record":{"id":"846b134aaa246a6f","repo":"shadow1ng/fscan","slug":"s-s-w-webscan-request-parse-error-poc-name","errorCode":null,"errorMessage":"%s %s: %w (webscan_request_parse_error, poc name)","messagePattern":"(.+?) (.+?): %w \\(webscan_request_parse_error, poc name\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"webscan/lib/poc_executor.go","lineNumber":153,"sourceCode":"\n\treturn decls\n}\n\n// executePoc 执行单个POC检测\nfunc executePoc(oReq *http.Request, p *Poc, pocCtx *POCContext) (bool, string, error) {\n\t// 收集POC变量声明\n\tvarDecls := collectVarDeclarations(p)\n\n\t// 从基础环境扩展（复用缓存的基础环境，仅添加变量声明）\n\tenv, err := ExtendEnvWithVars(varDecls)\n\tif err != nil {\n\t\treturn false, \"\", fmt.Errorf(\"%s %s: %w\", i18n.GetText(\"webscan_exec_env_error\"), p.Name, err)\n\t}\n\n\t// 解析请求\n\treq, err := ParseRequest(oReq)\n\tif err != nil {\n\t\treturn false, \"\", fmt.Errorf(\"%s %s: %w\", i18n.GetText(\"webscan_request_parse_error\"), p.Name, err)\n\t}\n\n\t// 初始化变量映射\n\tvariableMap := make(map[string]interface{})\n\tdefer func() { variableMap = nil }()\n\tvariableMap[\"request\"] = req\n\n\t// 处理设置项\n\tfor _, item := range p.Set {\n\t\tkey, expression := item.Key, item.Value\n\t\tif expression == \"newReverse()\" {\n\t\t\tif !pocCtx.DNSLog {\n\t\t\t\treturn false, \"\", nil\n\t\t\t}\n\t\t\tvariableMap[key] = newReverse(pocCtx.DNSLog)\n\t\t\tcontinue\n\t\t}\n\t\tif _, err = evalset(env, variableMap, key, expression); err != nil {","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/webscan/lib/poc_executor.go#L135-L171","documentation":"This error is returned by executePoc in webscan/lib/poc_executor.go when ParseRequest fails to convert the incoming *http.Request into the scanner's internal Request representation. The wrapper prefixes the localized 'request parse error' message and the POC name, and wraps the underlying parse error with %w. It means the original target request could not be interpreted (bad URL/method form) before any POC rule runs.","triggerScenarios":"executePoc is called with an *http.Request whose URL, method, or headers cannot be parsed by ParseRequest — e.g. a malformed target URL with invalid characters or an unparsable host, so ParseRequest returns a non-nil err.","commonSituations":"Scanning a target whose URL was assembled from raw user input with spaces, control characters, or a schemeless/malformed authority; feeding HostInfo data with an invalid port or host into the web scanner; proxy-replayed requests with corrupted request lines.","solutions":["Inspect the wrapped inner error to see exactly which field ParseRequest rejected (URL, host, port, method).","Validate/normalize the target URL before invoking the scan (scheme prefix, valid host, numeric port 1-65535).","URL-encode spaces and special characters in the target path before passing the request to the scanner.","Reproduce with url.Parse on the same URL locally to confirm it is the failing component."],"exampleFix":"// before\nexecutePoc(badReq, poc, ctx) // errors: webscan_request_parse_error\n// after\nu, err := url.Parse(target.URL)\nif err != nil || u.Hostname() == \"\" {\n    return fmt.Errorf(\"invalid target URL %q: %w\", target.URL, err)\n}\nexecutePoc(badReq, poc, ctx)","handlingStrategy":"validation","validationCode":"func validTarget(req *http.Request) error {\n    if req == nil || req.URL == nil || req.URL.Host == \"\" {\n        return fmt.Errorf(\"request has no parseable URL/host\")\n    }\n    if _, err := url.Parse(req.URL.String()); err != nil {\n        return fmt.Errorf(\"unparsable target URL: %w\", err)\n    }\n    return nil\n}","typeGuard":"func hasParseableURL(req *http.Request) bool {\n    return req != nil && req.URL != nil && req.URL.Host != \"\"\n}","tryCatchPattern":"ok, _, err := executePoc(req, poc, ctx)\nif err != nil {\n    var parseErr error\n    if errors.As(err, &parseErr) && strings.Contains(err.Error(), i18n.GetText(\"webscan_request_parse_error\")) {\n        log.Printf(\"skipping %s: unparseable request: %v\", poc.Name, err)\n        return\n    }\n    return err\n}","preventionTips":["Normalize and validate target URLs (scheme, host, encoded path) before handing requests to the scanner","Reject targets containing spaces or control characters at ingestion time","Sanity-check HostInfo fields (host non-empty, port numeric) before scanning"],"tags":["go","webscan","url-parsing","request"],"backgroundTag":"invalid-url-format","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}