{"record":{"id":"b12de2cd176cf3d1","repo":"ffuf/ffuf","slug":"bad-ffufhash-value","errorCode":null,"errorMessage":"bad FFUFHASH value","messagePattern":"bad FFUFHASH value","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/engine/history.go","lineNumber":104,"sourceCode":"\t\t\t\to.Matcher.Status = f.Repr()\n\t\t\tcase \"time\":\n\t\t\t\to.Matcher.Time = f.Repr()\n\t\t\tcase \"words\":\n\t\t\t\to.Matcher.Words = f.Repr()\n\t\t\t}\n\t\t}\n\t}\n\treturn o\n}\n\nfunc calculateHistoryHash(options []byte) string {\n\treturn fmt.Sprintf(\"%x\", sha256.Sum256(options))\n}\n\nfunc SearchHash(hash string) ([]ConfigOptionsHistory, int, error) {\n\tcoptions := make([]ConfigOptionsHistory, 0)\n\tif len(hash) < 6 {\n\t\treturn coptions, 0, errors.New(\"bad FFUFHASH value\")\n\t}\n\thistorypart := hash[0:5]\n\tposition, err := strconv.ParseInt(hash[5:], 16, 32)\n\tif err != nil {\n\t\treturn coptions, 0, errors.New(\"bad positional value in FFUFHASH\")\n\t}\n\tall_dirs, err := os.ReadDir(ffuf.HISTORYDIR)\n\tif err != nil {\n\t\treturn coptions, 0, err\n\t}\n\tmatched_dirs := make([]string, 0)\n\tfor _, filename := range all_dirs {\n\t\tif filename.IsDir() {\n\t\t\tif strings.HasPrefix(strings.ToLower(filename.Name()), strings.ToLower(historypart)) {\n\t\t\t\tmatched_dirs = append(matched_dirs, filename.Name())\n\t\t\t}\n\t\t}\n\t}","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/ffuf/ffuf/blob/33c67d28c85b94589d029b3bcaff205a40cee9c4/pkg/engine/history.go#L86-L122","documentation":"SearchHash validates an FFUFHASH string (the 5-char history hash prefix plus a hex-encoded position) and rejects it when it is shorter than 6 characters, so it cannot possibly contain both the hash and positional parts. This is pure input-shape validation performed before any history directory is scanned; the offending input is the hash argument passed on the command line.","triggerScenarios":"Thrown at pkg/engine/history.go:104 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check that the value passed to -searchhash/FFUFHASH lookup is a full hash copied from a previous run's output, not a truncated or typo'd string","Trim surrounding whitespace or quotes accidentally included when copying the hash","If scripting the lookup, verify len(hash) >= 6 (and that chars 6+ are valid hex) before calling SearchHash"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"33c67d28c85b94589d029b3bcaff205a40cee9c4","analyzedAt":"2026-09-04T18:24:34.068Z","contentChangedAt":"2026-09-04T18:24:34.068Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}