{"record":{"id":"f153d1674a16c0bd","repo":"projectdiscovery/nuclei","slug":"could-not-create-request-s","errorCode":null,"errorMessage":"could not create request: %s","messagePattern":"could not create request: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/input/types/http.go","lineNumber":78,"sourceCode":"// BuildRequest builds a retryablehttp request from the request response\nfunc (rr *RequestResponse) BuildRequest() (*retryablehttp.Request, error) {\n\trr.once.Do(func() {\n\t\t// Request is optional: UnmarshalJSON only populates it when a \"request\"\n\t\t// key is present, so an entry carrying just a \"url\" leaves it nil.\n\t\t// Dereferencing it below would panic with a nil pointer instead of\n\t\t// surfacing a usable error, taking the whole scan down.\n\t\tif rr.Request == nil {\n\t\t\trr.reqErr = fmt.Errorf(\"could not create request: no request in request response\")\n\t\t\treturn\n\t\t}\n\t\turlx := rr.URL.Clone()\n\t\tvar body io.Reader = nil\n\t\tif rr.Request.Body != \"\" {\n\t\t\tbody = strings.NewReader(rr.Request.Body)\n\t\t}\n\t\treq, err := retryablehttp.NewRequestFromURL(rr.Request.Method, urlx, body)\n\t\tif err != nil {\n\t\t\trr.reqErr = fmt.Errorf(\"could not create request: %s\", err)\n\t\t\treturn\n\t\t}\n\t\trr.Request.Headers.Iterate(func(k, v string) bool {\n\t\t\treq.Header.Add(k, v)\n\t\t\treturn true\n\t\t})\n\t\tif req.Header.Get(\"User-Agent\") == \"\" {\n\t\t\tuserAgent := useragent.PickRandom()\n\t\t\treq.Header.Set(\"User-Agent\", userAgent.Raw)\n\t\t}\n\t\trr.req = req\n\t})\n\treturn rr.req, rr.reqErr\n}\n\n// To be implemented in the future\n// func (rr *RequestResponse) BuildUnsafeRequest()\n","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/input/types/http.go#L60-L96","documentation":"BuildRequest() had a Request object but retryablehttp.NewRequestFromURL(rr.Request.Method, urlx, body) rejected it. The underlying %s is the retryablehttp error: usually an invalid HTTP method token or a nil/invalid URL (empty scheme or host after cloning rr.URL).","triggerScenarios":"request.method containing spaces, control characters, or being empty; a \"url\" value that parsed into an URL without host/scheme so the cloned URL is unusable for request construction.","commonSituations":"Method set to \"get x\", \"POST; charset=utf-8\" or left empty in JSON input; url missing host (\"/api/foo\" stored as the top-level url field); upstream tooling exporting malformed HAR-like JSON.","solutions":["Use a valid HTTP method token in request.method (GET, POST, custom verbs like PROPFIND are fine)","Ensure the top-level \"url\" is absolute with scheme and host, e.g. https://example.com/api","Inspect the wrapped %s text: 'net/http: invalid method' points at the method, URL errors point at the url field"],"exampleFix":"// before\n{\"url\": \"example.com/api\", \"request\": {\"method\": \"GET /x\"}}\n\n// after\n{\"url\": \"https://example.com/api\", \"request\": {\"method\": \"GET\"}}","handlingStrategy":"validation","validationCode":"func validMethod(m string) bool {\n    if m == \"\" { return false }\n    for _, r := range m {\n        if !(r >= 'A' && r <= 'Z' || r >= 'a' && r <= 'z' || r >= '0' && r <= '9' || strings.ContainsRune(\"!#$%&'*+.^_|~-\", r)) {\n            return false\n        }\n    }\n    return true\n}\n\nif u, err := url.Parse(entry.URL); err != nil || u.Scheme == \"\" || u.Host == \"\" || !validMethod(entry.Request.Method) {\n    // reject entry before it reaches BuildRequest\n}","typeGuard":null,"tryCatchPattern":"Catch the BuildRequest error and inspect the wrapped retryablehttp text: 'net/http: invalid method' → fix the method field; url errors → fix the url field; the same sync.Once caching caveat as error 181 applies.","preventionTips":["Always emit absolute URLs with scheme+host in generated input files","Restrict methods to standard tokens or vendor-approved custom verbs","Run a one-pass linter over JSON inputs before large scans"],"tags":["input","http","validation","sdk"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}