crowdsecurity/crowdsec · error

unable to parse target '%s': %w

Error message

unable to parse target '%s': %w

What it means

url.Parse rejected the nuclei target host (NucleiTargetHost) while preparing a hubtest appsec test run with a nuclei template. The configured target URL for the test is malformed (bad scheme, port, or percent-encoding), so the nuclei scan cannot proceed.

Source

Thrown at pkg/hubtest/hubtest_item.go:391

	}

	// wait for the appsec port to be available
	if _, err = IsAlive(ctx, t.AppSecHost); err != nil {
		crowdsecLog, err2 := os.ReadFile(crowdsecLogFile)
		if err2 != nil {
			log.Errorf("unable to read crowdsec log file '%s': %s", crowdsecLogFile, err)
		} else {
			log.Errorf("crowdsec log file '%s'", crowdsecLogFile)
			log.Errorf("%s\n", string(crowdsecLog))
		}

		return fmt.Errorf("appsec is down: %w", err)
	}

	// check if the target is available
	nucleiTargetParsedURL, err := url.Parse(t.NucleiTargetHost)
	if err != nil {
		return fmt.Errorf("unable to parse target '%s': %w", t.NucleiTargetHost, err)
	}

	nucleiTargetHost := nucleiTargetParsedURL.Host
	if _, err = IsAlive(ctx, nucleiTargetHost); err != nil {
		return fmt.Errorf("target is down: %w", err)
	}

	nucleiConfig := NucleiConfig{
		Path:      "nuclei",
		OutputDir: t.RuntimePath,
		CmdLineOptions: []string{
			"-ev",    // allow variables from environment
			"-nc",    // no colors in output
			"-dresp", // dump response
			"-j",     // json output
		},
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the target URL in the hubtest test configuration — include scheme and valid host:port (e.g. http://127.0.0.1:7422)
2. Quote URLs containing special characters in YAML to avoid parsing surprises

Example fix

// before (config)
nuclei_target_host: "127.0.0.1:8080 "
// after
nuclei_target_host: "http://127.0.0.1:8080"

u, err := url.Parse(nucleiTargetHost)
if err != nil || u.Host == "" {
	return fmt.Errorf("invalid NucleiTargetHost %q", nucleiTargetHost)
}

When it happens

Trigger: t.NucleiTargetHost in the test's config is empty, malformed (e.g. missing scheme or stray characters), or contains spaces/newlines so url.Parse rejects it.

Common situations: Test config file typo in the nuclei target host field; host set without a port where required; environment-variable interpolation left the value blank; trailing quotes or whitespace pasted into config.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• empty loki host
• ref cannot be empty
• on_challenge hooks are only valid in-band, not under outofba
• on_challenge_submit hooks are only valid in-band, not under
• max_body_size must be a positive integer

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6e394c311ce9172d. Report an issue: GitHub.