{"record":{"id":"d6571ba36a91cc1c","repo":"projectdiscovery/nuclei","slug":"could-not-create-request-no-request-in-request-re","errorCode":null,"errorMessage":"could not create request: no request in request response","messagePattern":"could not create request: no request in request response","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/input/types/http.go","lineNumber":68,"sourceCode":"\t}\n\tif rr.Request != nil {\n\t\tcloned.Request = rr.Request.Clone()\n\t}\n\tif rr.Response != nil {\n\t\tcloned.Response = rr.Response.Clone()\n\t}\n\treturn cloned\n}\n\n// BuildRequest builds a retryablehttp request from the request response\nfunc (rr *RequestResponse) BuildRequest() (*retryablehttp.Request, error) {\n\trr.once.Do(func() {\n\t\t// Request is optional: UnmarshalJSON only populates it when a \"request\"\n\t\t// key is present, so an entry carrying just a \"url\" leaves it nil.\n\t\t// Dereferencing it below would panic with a nil pointer instead of\n\t\t// surfacing a usable error, taking the whole scan down.\n\t\tif rr.Request == nil {\n\t\t\trr.reqErr = fmt.Errorf(\"could not create request: no request in request response\")\n\t\t\treturn\n\t\t}\n\t\turlx := rr.URL.Clone()\n\t\tvar body io.Reader = nil\n\t\tif rr.Request.Body != \"\" {\n\t\t\tbody = strings.NewReader(rr.Request.Body)\n\t\t}\n\t\treq, err := retryablehttp.NewRequestFromURL(rr.Request.Method, urlx, body)\n\t\tif err != nil {\n\t\t\trr.reqErr = fmt.Errorf(\"could not create request: %s\", err)\n\t\t\treturn\n\t\t}\n\t\trr.Request.Headers.Iterate(func(k, v string) bool {\n\t\t\treq.Header.Add(k, v)\n\t\t\treturn true\n\t\t})\n\t\tif req.Header.Get(\"User-Agent\") == \"\" {\n\t\t\tuserAgent := useragent.PickRandom()","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/input/types/http.go#L50-L86","documentation":"RequestResponse.BuildRequest() found rr.Request nil. UnmarshalJSON only sets Request when the JSON entry contains a \"request\" key, so an entry carrying just a \"url\" leaves it nil. Instead of panicking on the nil dereference, BuildRequest (guarded by sync.Once) records this error and returns it.","triggerScenarios":"Loading JSON input entries shaped {\"url\":\"https://host/path\"} (no \"request\" object) and then calling BuildRequest() on them, e.g. through the http input provider or fuzzing flow that needs a full request.","commonSituations":"Hand-written target JSON lists that only carry URLs; pipelines that strip the \"request\" field to 'simplify' input; mixing list-mode entries into a format that later requires full request-response pairs.","solutions":["Give every entry a request object: {\"url\":\"https://host/path\",\"request\":{\"method\":\"GET\",\"headers\":{},\"body\":\"\"}}","If you only need URL targets, use plain list mode (-im list or a newline-separated file) instead of a request/response format","In SDK code, check rr.Request != nil before calling BuildRequest()"],"exampleFix":"// before\n{\"url\": \"https://example.com/api\"}\n\n// after\n{\"url\": \"https://example.com/api\", \"request\": {\"method\": \"GET\", \"headers\": {}, \"body\": \"\"}}","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"func HasRequest(rr *types.RequestResponse) bool {\n    return rr != nil && rr.Request != nil\n}\n\n// usage\nif !HasRequest(rr) {\n    // fill in a default request or skip this entry before BuildRequest()\n}","tryCatchPattern":"Callers of BuildRequest should treat the returned error as 'entry incomplete': either populate rr.Request (e.g. method GET, empty headers) and rebuild on a fresh RequestResponse, or drop the entry and log it. Because the error is cached in sync.Once, retrying BuildRequest on the same object always returns the same error.","preventionTips":["Keep URL-only entries in list mode; use request/response JSON only when you carry the full request","Validate input files once at startup: every object must have both 'url' and 'request'","When generating JSON from RequestResponse via MarshalJSON, the 'request' key is always emitted — stripping it downstream is what creates this state"],"tags":["input","http","json","sdk"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}