{"record":{"id":"86a6cde4fac2d4f1","repo":"kgretzky/evilginx2","slug":"force-post-missing-search-search-field","errorCode":null,"errorMessage":"force_post: missing search `search` field","messagePattern":"force_post: missing search `search` field","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":722,"sourceCode":"\t\t\t}\n\t\t\tif op.Force == nil || len(*op.Force) == 0 {\n\t\t\t\treturn fmt.Errorf(\"force_post: missing or empty `force` field\")\n\t\t\t}\n\n\t\t\tfpf := ForcePost{}\n\t\t\tfpf.path, err = regexp.Compile(p.paramVal(*op.Path))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tfpf.tp = *op.Type\n\n\t\t\tif op.Search != nil {\n\t\t\t\tfor _, op_s := range *op.Search {\n\t\t\t\t\tif op_s.Key == nil {\n\t\t\t\t\t\treturn fmt.Errorf(\"force_post: missing search `key` field\")\n\t\t\t\t\t}\n\t\t\t\t\tif op_s.Search == nil {\n\t\t\t\t\t\treturn fmt.Errorf(\"force_post: missing search `search` field\")\n\t\t\t\t\t}\n\n\t\t\t\t\tf_s := ForcePostSearch{}\n\t\t\t\t\tf_s.key, err = regexp.Compile(p.paramVal(*op_s.Key))\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn err\n\t\t\t\t\t}\n\t\t\t\t\tf_s.search, err = regexp.Compile(p.paramVal(*op_s.Search))\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn err\n\t\t\t\t\t}\n\t\t\t\t\tfpf.search = append(fpf.search, f_s)\n\t\t\t\t}\n\t\t\t}\n\t\t\tfor _, op_f := range *op.Force {\n\t\t\t\tif op_f.Key == nil {\n\t\t\t\t\treturn fmt.Errorf(\"force_post: missing force `key` field\")\n\t\t\t\t}","sourceCodeStart":704,"sourceCodeEnd":740,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L704-L740","documentation":"Thrown when a force_post `search` entry lacks the `search` field. The `search` value is a regexp (compiled with p.paramVal substitution) used to locate content within the POST parameter named by `key`; without it the search entry is invalid and the phishlet fails validation.","triggerScenarios":"Phishlet YAML has a force_post `search:` list item with `key:` set but no `search:` field; phishlet load/validate is executed.","commonSituations":"Half-written search rules; field-name typos (`match:`, `regex:` instead of `search:`); deleting the regexp line while keeping the entry; mixing schemas from other phishlet directives like regex_sub.","solutions":["Add a valid `search:` regexp to each force_post search entry","Correct field-name typos to `search`","Delete the empty search entry if the search is unnecessary"],"exampleFix":"# before\nsearch:\n  - key: 'username'\n# after\nsearch:\n  - key: 'username'\n    search: '[^&]*'","handlingStrategy":"validation","validationCode":"for _, op := range forcePosts {\n    if op.Search == nil { continue }\n    for j, s := range *op.Search {\n        if s.Search == nil {\n            return fmt.Errorf(\"force_post search[%d]: `search` regexp is required\", j)\n        }\n        if _, err := regexp.Compile(*s.Search); err != nil {\n            return fmt.Errorf(\"force_post search[%d]: invalid regexp: %v\", j, err)\n        }\n    }\n}","typeGuard":"func searchHasRegexp(s ForcePostSearch) bool { return s.Search != nil }","tryCatchPattern":null,"preventionTips":["Pair every search `key` with a `search` regexp","Test regexps before adding them to the phishlet","Avoid renaming the field to match/regex - it must be `search`","Validate the full phishlet after each edit"],"tags":["phishlet","config-validation","force-post","regex"],"backgroundTag":"phishlet-config-validation","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}