{"record":{"id":"e515c0541f3c8d47","repo":"projectdiscovery/nuclei","slug":"missing-url-in-request-response","errorCode":null,"errorMessage":"missing url in request response","messagePattern":"missing url in request response","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/input/types/http.go","lineNumber":136,"sourceCode":"\t}\n\tm[\"request\"] = reqBin\n\trespBin, err := json.Marshal(rr.Response)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tm[\"response\"] = respBin\n\treturn json.Marshal(m)\n}\n\n// UnmarshalJSON unmarshals the request response from json\nfunc (rr *RequestResponse) UnmarshalJSON(data []byte) error {\n\tvar m map[string]json.Message\n\tif err := json.Unmarshal(data, &m); err != nil {\n\t\treturn err\n\t}\n\turlStrRaw, ok := m[\"url\"]\n\tif !ok {\n\t\treturn fmt.Errorf(\"missing url in request response\")\n\t}\n\tvar urlStr string\n\tif err := json.Unmarshal(urlStrRaw, &urlStr); err != nil {\n\t\treturn err\n\t}\n\tparsed, err := urlutil.ParseAbsoluteURL(urlStr, false)\n\tif err != nil {\n\t\treturn err\n\t}\n\trr.URL = *parsed\n\n\treqBin, ok := m[\"request\"]\n\tif ok {\n\t\tvar req HttpRequest\n\t\tif err := json.Unmarshal(reqBin, &req); err != nil {\n\t\t\treturn err\n\t\t}\n\t\trr.Request = &req","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/input/types/http.go#L118-L154","documentation":"RequestResponse.UnmarshalJSON requires every JSON input entry to carry a top-level \"url\" string; this error fires when the key is absent. Note the value must also survive urlutil.ParseAbsoluteURL (absolute, with host) or unmarshalling fails with a different error.","triggerScenarios":"Feeding a JSON input file where an object has \"request\" and/or \"response\" but no \"url\" key; renaming the field (e.g. \"URI\") or misplacing it one nesting level too deep.","commonSituations":"Hand-edited request-response JSON files; converting Burp/proxy exports and dropping the url field; entries where url is present but empty string (then ParseAbsoluteURL fails instead).","solutions":["Add \"url\": \"https://host/path\" to every object in the input file","Validate the file before scanning, e.g. jq 'map(select(.url == null))' should return []","If the input is really just URLs, use list mode (-im list) which has no such requirement"],"exampleFix":"# before\n{\"request\": {\"method\": \"GET\", \"headers\": {}, \"body\": \"\"}}\n\n# after\n{\"url\": \"https://example.com/api\", \"request\": {\"method\": \"GET\", \"headers\": {}, \"body\": \"\"}}","handlingStrategy":"validation","validationCode":"# jq preflight over the input file\njq -e 'type == \"array\" and all(.[]; has(\"url\") and (.url | type == \"string\") and (.url | startswith(\"http\")))' input.json","typeGuard":null,"tryCatchPattern":"If using the SDK, wrap json.Unmarshal on each entry; on this exact message skip and log the offending entry index rather than aborting the whole provider build.","preventionTips":["Treat 'url' as mandatory in any tooling that writes request-response JSON","Use MarshalJSON-produced files as the canonical shape: {url, request, response}","Prefer list mode for plain target lists"],"tags":["input","json","parsing"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}