{"record":{"id":"af22711c68c7966d","repo":"projectdiscovery/nuclei","slug":"empty-filename","errorCode":null,"errorMessage":"empty filename","messagePattern":"empty filename","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/catalog/aws/catalog.go","lineNumber":86,"sourceCode":"\t\t\tconfig.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(accessKey, secretKey, \"\")),\n\t\t\tconfig.WithRegion(region))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tc.svc = &s3svc{\n\t\t\tclient: s3.NewFromConfig(cfg),\n\t\t\tbucket: \"\",\n\t\t}\n\n\t\treturn nil\n\t}\n}\n\n// OpenFile downloads a file from S3 and returns the contents as an io.ReadCloser\nfunc (c Catalog) OpenFile(filename string) (io.ReadCloser, error) {\n\tif filename == \"\" {\n\t\treturn nil, errors.New(\"empty filename\")\n\t}\n\n\treturn c.svc.downloadKey(filename)\n}\n\n// GetTemplatePath looks for a target string performing a simple substring check\n// against all S3 keys. If the input includes a wildcard (*) it is removed.\nfunc (c Catalog) GetTemplatePath(target string) ([]string, error) {\n\ttarget = strings.ReplaceAll(target, \"*\", \"\")\n\n\tkeys, err := c.svc.getAllKeys()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar matches []string\n\tfor _, key := range keys {\n\t\tif strings.Contains(key, target) {","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/catalog/aws/catalog.go#L68-L104","documentation":"The request target (second field of the raw request line) goes through urlutil.ParseURL with strict semantics; invalid percent-encoding, control characters, or an unparseable target fail as 'could not parse request URL'. This happens before the self-contained host policy check, so no request is attempted.","triggerScenarios":"Targets like /a%zz (bad escape), a path with an unencoded space, or a dynamic variable ({{path}}) rendering with characters that are invalid in a URL.","commonSituations":"Fuzzing payloads or scraped paths injected into the request line; templates assuming browser-lenient URL parsing.","solutions":["Percent-encode unsafe bytes in the target (%20 for spaces, valid %-sequences)","Wrap dynamic values with {{url_encode(...)}} in the template","Validate the template plus a sample target locally before a large run"],"exampleFix":"# before\nGET /my file.txt HTTP/1.1\n# after\nGET /my%20file.txt HTTP/1.1","handlingStrategy":"validation","validationCode":"import \"net/url\"\n\nfunc targetParses(target string) bool {\n    _, err := url.Parse(target)\n    return err == nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Encode dynamic path segments with url_encode in templates","Avoid raw spaces in request targets","Pre-parse generated targets in fuzzing harnesses"],"tags":["http","url","parsing","template"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}