{"record":{"id":"b4b4d40b815fdb98","repo":"owasp-amass/amass","slug":"failed-to-provide-a-valid-http-method","errorCode":null,"errorMessage":"failed to provide a valid HTTP method","messagePattern":"failed to provide a valid HTTP method","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/net/http/http.go","lineNumber":179,"sourceCode":"\t\tProtoMajor: resp.ProtoMajor,\n\t\tProtoMinor: resp.ProtoMinor,\n\t\tHeader:     HdrToAmassHeader(resp.Header),\n\t\tBody:       body,\n\t\tLength:     int64(len(body)),\n\t\tTLS:        resp.TLS,\n\t}\n}\n\n// RequestWebPage returns the response headers, body, and status code for the provided URL when successful.\nfunc RequestWebPage(ctx context.Context, client *http.Client, r *Request) (*Response, error) {\n\tif r == nil {\n\t\treturn nil, errors.New(\"failed to provide a valid Amass HTTP request\")\n\t}\n\n\tif r.Method == \"\" {\n\t\tr.Method = http.MethodGet\n\t} else if r.Method != http.MethodGet && r.Method != http.MethodPost && r.Method != http.MethodDelete {\n\t\treturn nil, errors.New(\"failed to provide a valid HTTP method\")\n\t}\n\n\treq, err := http.NewRequestWithContext(ctx, r.Method, r.URL, strings.NewReader(r.Body))\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treq.Close = true\n\n\tif r.Auth != nil && r.Auth.Username != \"\" && r.Auth.Password != \"\" {\n\t\treq.SetBasicAuth(r.Auth.Username, r.Auth.Password)\n\t}\n\n\treq.Header.Set(\"User-Agent\", UserAgent)\n\treq.Header.Set(\"Accept\", Accept)\n\treq.Header.Set(\"Accept-Language\", AcceptLang)\n\tfor k, values := range r.Header {\n\t\tfor _, v := range values {\n\t\t\treq.Header.Set(k, v)","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/owasp-amass/amass/blob/79299dce87b0085db0f2f4ef3e9c52cccb49f514/internal/net/http/http.go#L161-L197","documentation":"RequestWebPage in internal/net/http/http.go validates that the request struct's Method field is one of GET, POST, or DELETE before building the net/http request. If Method is set to any other value (or an invalid verb), the function refuses to proceed and returns this error instead of issuing an HTTP call. It exists to catch misuse of the Amass HTTP request wrapper early.","triggerScenarios":"Setting Request.Method to a non-supported verb (e.g. PUT, PATCH, HEAD, TRACE, CONNECT) or a misspelled/lowercase method string before calling RequestWebPage.","commonSituations":"Porting code that used http.NewRequest with PUT/PATCH directly into the Amass wrapper; typos like \"get\" instead of \"GET\"; programmatically derived methods from config files that allow arbitrary verbs.","solutions":["Change the request Method to http.MethodGet, http.MethodPost, or http.MethodDelete (uppercase).","If the upstream API requires PUT/PATCH/HEAD, bypass the wrapper and use net/http directly.","Leave Method empty so the wrapper defaults it to GET."],"exampleFix":"// before\nreq := &nethttp.Request{Method: \"PUT\", URL: u}\nresp, err := nethttp.RequestWebPage(ctx, req)\n// after\nreq := &nethttp.Request{Method: http.MethodPost, URL: u, Body: payload}\nresp, err := nethttp.RequestWebPage(ctx, req)","handlingStrategy":"validation","validationCode":"if m := req.Method; m != \"\" && m != http.MethodGet && m != http.MethodPost && m != http.MethodDelete {\n    return fmt.Errorf(\"unsupported method %q: use GET, POST, or DELETE\", m)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only assign http.Method* constants, never string literals.","Leave Method empty to get the GET default.","Centralize request construction in one helper that whitelists methods."],"tags":["http","validation","go"],"backgroundTag":"invalid-enum-value","analyzedSha":"79299dce87b0085db0f2f4ef3e9c52cccb49f514","analyzedAt":"2026-09-06T08:22:48.198Z","contentChangedAt":"2026-09-06T08:22:48.198Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}