{"record":{"id":"d50e42fb36be73ee","repo":"kgretzky/evilginx2","slug":"sub-filters-missing-replace-field","errorCode":null,"errorMessage":"sub_filters: missing `replace` field","messagePattern":"sub_filters: missing `replace` field","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":454,"sourceCode":"\tif fp.SubFilters != nil {\n\t\tfor _, sf := range *fp.SubFilters {\n\t\t\tif sf.Hostname == nil {\n\t\t\t\treturn fmt.Errorf(\"sub_filters: missing `triggers_on` field\")\n\t\t\t}\n\t\t\tif sf.Sub == nil {\n\t\t\t\treturn fmt.Errorf(\"sub_filters: missing `orig_sub` field\")\n\t\t\t}\n\t\t\tif sf.Domain == nil {\n\t\t\t\treturn fmt.Errorf(\"sub_filters: missing `domain` field\")\n\t\t\t}\n\t\t\tif sf.Mimes == nil {\n\t\t\t\treturn fmt.Errorf(\"sub_filters: missing `mimes` field\")\n\t\t\t}\n\t\t\tif sf.Search == nil {\n\t\t\t\treturn fmt.Errorf(\"sub_filters: missing `search` field\")\n\t\t\t}\n\t\t\tif sf.Replace == nil {\n\t\t\t\treturn fmt.Errorf(\"sub_filters: missing `replace` field\")\n\t\t\t}\n\t\t\tif sf.WithParams == nil {\n\t\t\t\tsf.WithParams = &[]string{}\n\t\t\t}\n\n\t\t\tfor n := range *sf.Mimes {\n\t\t\t\t(*sf.Mimes)[n] = p.paramVal((*sf.Mimes)[n])\n\t\t\t}\n\t\t\tp.addSubFilter(p.paramVal(*sf.Hostname), p.paramVal(*sf.Sub), p.paramVal(*sf.Domain), *sf.Mimes, p.paramVal(*sf.Search), p.paramVal(*sf.Replace), sf.RedirectOnly, *sf.WithParams)\n\t\t}\n\t}\n\tif fp.JsInject != nil {\n\t\tfor _, js := range *fp.JsInject {\n\t\t\tif js.TriggerDomains == nil {\n\t\t\t\treturn fmt.Errorf(\"js_inject: missing `trigger_domains` field\")\n\t\t\t}\n\t\t\tif js.TriggerPaths == nil {\n\t\t\t\treturn fmt.Errorf(\"js_inject: missing `trigger_paths` field\")","sourceCodeStart":436,"sourceCodeEnd":472,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L436-L472","documentation":"Each `sub_filters` entry requires a `replace` string substituted for the `search` regex matches. The entry's `replace` field was nil, so validation fails. This is the last mandatory sub_filter field checked; `with_params` is optional and defaults to an empty list when absent.","triggerScenarios":"A `sub_filters:` entry omits `replace:`; core/phishlet.go's `if sf.Replace == nil` check fires after all other required fields validate.","commonSituations":"Truncating the entry after `search` while editing; assuming search-only filters are allowed; paste from docs cut off before the replace line.","solutions":["Add `replace: '<replacement>'` (typically using the `{domain}` placeholder, e.g. `replace: 'accounts.{domain}'`) to the entry","Confirm search and replace are consistent with each other (the replacement should re-substitute the phishing domain)","Reload the phishlet; all remaining sub_filter checks should now pass"],"exampleFix":"// before\nsub_filters:\n  - triggers_on: 'auth.example.com'\n    orig_sub: 'accounts'\n    domain: 'example.com'\n    mimes: ['text/html']\n    search: 'accounts\\\\.example\\\\.com'\n// after\nsub_filters:\n  - triggers_on: 'auth.example.com'\n    orig_sub: 'accounts'\n    domain: 'example.com'\n    mimes: ['text/html']\n    search: 'accounts\\\\.example\\\\.com'\n    replace: 'accounts.{domain}'","handlingStrategy":"validation","validationCode":"for i, sf in enumerate(cfg.get('sub_filters') or []):\n    if sf.get('replace') is None:\n        raise ValueError(f\"sub_filters[{i}]: missing `replace` field\")","typeGuard":"func validSubFilter(sf SubFilter) bool { return sf.Replace != nil }","tryCatchPattern":null,"preventionTips":["Use the `{domain}` placeholder in replace for the phishing host","Always pair search+replace in the same edit","Note `with_params` is optional — omitting it is safe, unlike replace"],"tags":["phishlet","config-validation","sub-filters","missing-field"],"backgroundTag":"missing-required-config-field","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}