{"record":{"id":"abc2f8ae8995219b","repo":"kgretzky/evilginx2","slug":"js-inject-missing-script-field","errorCode":null,"errorMessage":"js_inject: missing `script` field","messagePattern":"js_inject: missing `script` field","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":475,"sourceCode":"\t\t\t\tsf.WithParams = &[]string{}\n\t\t\t}\n\n\t\t\tfor n := range *sf.Mimes {\n\t\t\t\t(*sf.Mimes)[n] = p.paramVal((*sf.Mimes)[n])\n\t\t\t}\n\t\t\tp.addSubFilter(p.paramVal(*sf.Hostname), p.paramVal(*sf.Sub), p.paramVal(*sf.Domain), *sf.Mimes, p.paramVal(*sf.Search), p.paramVal(*sf.Replace), sf.RedirectOnly, *sf.WithParams)\n\t\t}\n\t}\n\tif fp.JsInject != nil {\n\t\tfor _, js := range *fp.JsInject {\n\t\t\tif js.TriggerDomains == nil {\n\t\t\t\treturn fmt.Errorf(\"js_inject: missing `trigger_domains` field\")\n\t\t\t}\n\t\t\tif js.TriggerPaths == nil {\n\t\t\t\treturn fmt.Errorf(\"js_inject: missing `trigger_paths` field\")\n\t\t\t}\n\t\t\tif js.Script == nil {\n\t\t\t\treturn fmt.Errorf(\"js_inject: missing `script` field\")\n\t\t\t}\n\t\t\tfor n := range *js.TriggerDomains {\n\t\t\t\t(*js.TriggerDomains)[n] = p.paramVal((*js.TriggerDomains)[n])\n\t\t\t}\n\t\t\tfor n := range *js.TriggerPaths {\n\t\t\t\t(*js.TriggerPaths)[n] = p.paramVal((*js.TriggerPaths)[n])\n\t\t\t}\n\t\t\terr := p.addJsInject(*js.TriggerDomains, *js.TriggerPaths, js.TriggerParams, p.paramVal(*js.Script))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\tif fp.Intercept != nil {\n\t\tfor _, ic := range *fp.Intercept {\n\t\t\tvar err error\n\t\t\tvar body, mime string\n\t\t\tif ic.Domain == nil {","sourceCodeStart":457,"sourceCodeEnd":493,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L457-L493","documentation":"Each `js_inject` entry must define `script`, the JavaScript source injected into matched responses. The entry's `script` field was nil, so validation fails — injecting nothing would be meaningless. This is the final mandatory js_inject field before the domains/paths lists are parameter-substituted.","triggerScenarios":"A `js_inject:` entry omits the `script:` key (or its value line was deleted); core/phishlet.go's `if js.Script == nil` check fires during phishlet validation.","commonSituations":"Creating a placeholder js_inject block intending to fill the script later; YAML multiline script (| or >) block badly indented so the key parses as nil; copy/paste losing the script body.","solutions":["Add `script: '<javascript>'` or a literal block (`script: |` followed by indented JS) to the entry","If using a multiline block, indent the script body consistently under `script: |` so YAML parses it as a non-empty string","Reload the phishlet and confirm no further validation errors are reported"],"exampleFix":"// before\njs_inject:\n  - trigger_domains: ['auth.example.com']\n    trigger_paths: ['/login']\n// after\njs_inject:\n  - trigger_domains: ['auth.example.com']\n    trigger_paths: ['/login']\n    script: \"console.log('injected')\"","handlingStrategy":"validation","validationCode":"for i, js in enumerate(cfg.get('js_inject') or []):\n    if js.get('script') in (None, ''):\n        raise ValueError(f\"js_inject[{i}]: missing `script` field\")","typeGuard":"func validJsInject(js JsInject) bool { return js.Script != nil }","tryCatchPattern":null,"preventionTips":["For multiline scripts use `script: |` with consistent body indentation","Don't create placeholder js_inject blocks with an empty script","Quote or block-scalar scripts containing special YAML characters"],"tags":["phishlet","config-validation","js-inject","missing-field"],"backgroundTag":"missing-required-config-field","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}