{"record":{"id":"8c1a67d5424102b0","repo":"projectdiscovery/nuclei","slug":"unresolved-dsl-placeholder-q-is-not-inside-a-stri","errorCode":null,"errorMessage":"unresolved DSL placeholder %q is not inside a string literal","messagePattern":"unresolved DSL placeholder %q is not inside a string literal","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/operators/matchers/dsl_string_markers.go","lineNumber":93,"sourceCode":"\tfor _, expr := range expressions.FindExpressions(expression, \"{{\", \"}}\", data) {\n\t\tif _, ok := seenComplex[expr]; ok {\n\t\t\tcontinue\n\t\t}\n\t\tseenComplex[expr] = struct{}{}\n\n\t\tmarker := \"{{\" + expr + \"}}\"\n\t\tfor start := 0; ; {\n\t\t\tindex := strings.Index(expression[start:], marker)\n\t\t\tif index < 0 {\n\t\t\t\tbreak\n\t\t\t}\n\n\t\t\tindex += start\n\t\t\tend := index + len(marker)\n\n\t\t\tstringSpan, ok := stringLiteralForSpan(stringSpans, index, end)\n\t\t\tif !ok {\n\t\t\t\treturn nil, fmt.Errorf(\"unresolved DSL placeholder %q is not inside a string literal\", expr)\n\t\t\t}\n\n\t\t\tgot := dslStringMarker{start: index, end: end, expr: expr, quote: stringSpan.quote}\n\t\t\tmarkers = append(markers, got)\n\t\t\toccupiedSpans = append(occupiedSpans, textSpan{start: index, end: end})\n\t\t\tstart = end\n\t\t}\n\t}\n\n\tfor _, match := range dslStringMarkerRegex.FindAllStringSubmatchIndex(expression, -1) {\n\t\tif len(match) < 4 || markerWithinSpans(match[0], match[1], occupiedSpans) {\n\t\t\tcontinue\n\t\t}\n\n\t\tstringSpan, ok := stringLiteralForSpan(stringSpans, match[0], match[1])\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"unresolved DSL placeholder %q is not inside a string literal\", expression[match[2]:match[3]])\n\t\t}","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/operators/matchers/dsl_string_markers.go#L75-L111","documentation":"Runtime resolution error from findDSLStringMarkers (pkg/operators/matchers/dsl_string_markers.go:93). For each expression found by expressions.FindExpressions (markers whose variables are absent from the data map), every literal occurrence of \"{{expr}}\" in the DSL source must lie fully inside a quoted string literal span. The first occurrence found outside string literals returns this error naming the placeholder.","triggerScenarios":"An unresolved {{placeholder}} used as a bare govaluate operand — e.g. `status_code == {{code}}` or `contains(body, {{needle}})` — where the variable is not in the evaluation data, so the marker survives substitution and is then detected outside quotes.","commonSituations":"Generator/fuzz variables referenced as numbers or identifiers instead of quoted strings in DSL matchers; typos in variable names that never resolve; using an extractor name that produced no value for this request.","solutions":["Wrap the placeholder in quotes so it becomes a string literal: `\"'{{needle}}'\"`","Correct or register the variable so it resolves before evaluation (e.g. ensure the generator defines it, or the referenced extractor ran)","Provide a default via `{{var || 'fallback'}}`-style preprocessing upstream, or restructure to compare in a word matcher","Enable -v logging to inspect which placeholder stays unresolved"],"exampleFix":"# before\ndsl:\n  - 'contains(body, {{needle}})'\n# after\ndsl:\n  - \"contains(body, '{{needle}}')\"","handlingStrategy":"validation","validationCode":"// ensure every identifier referenced in the dsl exists in data, else require quoting\nfor _, v := range govaluateVars(dslExpr) {\n\tif _, ok := data[v]; !ok && !strings.Contains(dslExpr, \"'{{\"+v+\"}}'\") {\n\t\treturn fmt.Errorf(\"variable %q unresolved and placeholder unquoted\", v)\n\t}\n}","typeGuard":"func markerInsideLiteral(expr, marker string, spans []stringLiteralSpan) bool { /* replicate stringLiteralForSpan check */ return true }","tryCatchPattern":"if err := m.Match(data); err != nil && strings.Contains(err.Error(), \"not inside a string literal\") {\n\t// quote the named placeholder and retest locally before redeploying\n}","preventionTips":["Quote every {{placeholder}} used as a string operand in DSL matchers","Verify generator payload names match marker names exactly","Run templates with -v during development to inspect unresolved markers"],"tags":["matcher","dsl","placeholders","template","runtime"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}