{"record":{"id":"b1ba3b2971ec6f50","repo":"projectdiscovery/nuclei","slug":"empty-input-provided-for-fuzzing","errorCode":null,"errorMessage":"empty input provided for fuzzing","messagePattern":"empty input provided for fuzzing","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/protocols/http/request_fuzz.go","lineNumber":55,"sourceCode":"func (request *Request) executeFuzzingRule(input *contextargs.Context, previous output.InternalEvent, callback protocols.OutputEventCallback) error {\n\t// methdology:\n\t// to check applicablity of rule, we first try to execute it with one value\n\t// if it is applicable, we execute all requests\n\t// if it is not applicable, we log and fail silently\n\n\t// check if target should be fuzzed or not\n\tif !request.ShouldFuzzTarget(input) {\n\t\turlx, _ := input.MetaInput.URL()\n\t\tif urlx != nil {\n\t\t\tgologger.Verbose().Msgf(\"[%s] fuzz: target(%s) not applicable for fuzzing\\n\", request.options.TemplateID, urlx.String())\n\t\t} else {\n\t\t\tgologger.Verbose().Msgf(\"[%s] fuzz: target(%s) not applicable for fuzzing\\n\", request.options.TemplateID, input.MetaInput.Input)\n\t\t}\n\t\treturn nil\n\t}\n\n\tif input.MetaInput.Input == \"\" && input.MetaInput.ReqResp == nil {\n\t\treturn errors.New(\"empty input provided for fuzzing\")\n\t}\n\n\t// ==== fuzzing when full HTTP request is provided =====\n\n\tif input.MetaInput.ReqResp != nil {\n\t\tbaseRequest, err := input.MetaInput.ReqResp.BuildRequest()\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"fuzz: could not build request obtained from target file\")\n\t\t}\n\t\trequest.addHeadersToRequest(baseRequest)\n\t\tinput.MetaInput.Input = baseRequest.String()\n\t\t// execute with one value first to checks its applicability\n\t\terr = request.executeAllFuzzingRules(input, previous, baseRequest, callback)\n\t\tif err != nil {\n\t\t\t// in case of any error, return it\n\t\t\tif fuzz.IsErrRuleNotApplicable(err) {\n\t\t\t\t// log and fail silently\n\t\t\t\tgologger.Verbose().Msgf(\"[%s] fuzz: %s\\n\", request.options.TemplateID, err)","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/protocols/http/request_fuzz.go#L37-L73","documentation":"The fuzzing execution path in request_fuzz.go requires a concrete target: either a URL string in input.MetaInput.Input or a full HTTP request supplied via input.MetaInput.ReqResp (raw request target file). If both are empty there is nothing to fuzz, so it errors before generating any fuzzed request. Note this only runs after ShouldFuzzTarget already passed, so the template applies but the input is blank.","triggerScenarios":"Running a fuzzing template with an empty target: blank line in the -l list, an unset CI variable, or SDK code calling ExecuteWithResults with Input == \"\" and no ReqResp populated.","commonSituations":"Target lists with trailing/blank lines; automation passing an empty string by mistake; SDK users forgetting to populate either MetaInput.Input or MetaInput.ReqResp.","solutions":["Provide a valid URL target, or pass a raw request file as the target so ReqResp gets populated","Sanitize input lists (remove blank lines) before feeding nuclei","In SDK code, guard: skip execution when both Input and ReqResp are empty"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if input.MetaInput.Input == \"\" && input.MetaInput.ReqResp == nil {\n    return nil // skip empty fuzzing input instead of erroring\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Strip blank lines from target lists before fuzzing runs","In SDK pipelines, assert that either a URL or a ReqResp is present before invoking fuzzing templates"],"tags":["fuzzing","http","input-validation","sdk"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}