google/tsunami-security-scanner · error · ValueError

No valid payload input is entered.

Error message

No valid payload input is entered.

What it means

The is_executed validator returned by _is_executed decodes the response data and checks it against the payload's regex. If the caller passes data=None (no response body to validate), ValueError('No valid payload input is entered.') is raised because execution cannot be assessed without data.

Solutions

1. Check data is not None before calling the validator; treat None as not-executed or as a request-level failure
2. Handle empty bodies upstream and skip execution validation for them
3. Catch ValueError from the validator and map it to a 'payload not observed' outcome
4. Ensure the request actually retrieves a body (use GET/POST with response reading) before validating

Example fix

// before
executed = is_executed(regex)(response, response_body)  # body may be None
// after
executed = response_body is not None and is_executed(regex)(response, response_body)

def safe_is_executed(validator, data):
    if data is None:
        return False
    return validator(data)

def has_response_body(data) -> bool:
    return data is not None and len(data) > 0

try:
    executed = check_payload_execution(response, data)
except ValueError:
    executed = False  # no data means payload could not be observed

When it happens

Trigger: Invoking the returned check_payload_execution callback with None as data, typically when a response body was empty/absent or the caller forwards an Optional bytes without a None check.

Common situations: A request returned no body (204, HEAD, connection error path) and the result was passed straight into the validator; plugin code that treats 'no response' and 'payload not executed' as the same case but the validator treats None as caller error.

Related errors

• Invalid network service
• URI scheme should be one of the following: 'http', 'https'
• Name cannot be None.
• Value cannot be None.
• Illegal header name .

AI-assisted analysis of google/tsunami-security-scanner@363ba87b35 (2026-09-13). Data as JSON: /api/errors/5a7741d331d87f51. Report an issue: GitHub.

Appendix: source

Thrown at plugin_server/py/plugin/payload/payload_generator.py:175

      payload: pg.PayloadDefinition,
      config: pg.PayloadGeneratorConfig,
      use_callback: bool,
  ) -> bool:
    return (
        config.vulnerability_type in payload.vulnerability_type
        and config.interpretation_environment
        == payload.interpretation_environment
        and config.execution_environment == payload.execution_environment
        and bool(payload.uses_callback_server.ByteSize()) == use_callback
    )


def _is_executed(regex: str) -> Callable[[Any, Optional[bytes]], bool]:
  """Check if the returned payload is executed by validating against the regex."""

  def check_payload_execution(_, data: Optional[bytes]) -> bool:
    if data is None:
      raise ValueError('No valid payload input is entered.')
    string = data.decode('utf-8')
    return bool(re.compile(regex).search(string)) or False

  return check_payload_execution

View on GitHub (pinned to 363ba87b35)