google/tsunami-security-scanner · error · ValueError

Parse payload does not have an interpretation environment.

Error message

Parse payload does not have an interpretation environment.

What it means

The same validator also requires each PayloadDefinition to specify an interpretation environment. If it is left as INTERPRETATION_ENVIRONMENT_UNSPECIFIED, ValueError is raised because payload selection and generation depend on knowing how the payload will be interpreted (e.g. exec vs HTML vs JavaScript).

Solutions

1. Set interpretation_environment to a concrete enum value (e.g. INTERPRETATION_ENVIRONMENT_EXEC, ..._HTML, ..._JAVASCRIPT) in the payload definition
2. Check the payload resource file for a missing/misspelled interpretation_environment line
3. When building payloads in code, always set both interpretation_environment and execution_environment
4. Run a load/validate test over all payload resources to catch unspecified fields early

Example fix

// before
# payload definition missing environment lines
execution_environment: EXECUTION_ENVIRONMENT_UNIX_SHELL
// after
interpretation_environment: INTERPRETATION_ENVIRONMENT_EXEC
execution_environment: EXECUTION_ENVIRONMENT_UNIX_SHELL

def validate_environments(payloads):
    for p in payloads:
        if p.interpretation_environment == pg.PayloadGeneratorConfig.InterpretationEnvironment.INTERPRETATION_ENVIRONMENT_UNSPECIFIED:
            raise ValueError(f'payload {p.name} missing interpretation environment')
    return payloads

try:
    payloads = payload_utility.get_parsed_payload(raw_payloads)
except ValueError as e:
    logging.error('Invalid payload environment: %s', e)
    payloads = []

When it happens

Trigger: get_parsed_payload receives a payload whose interpretation_environment field is unset/unspecified — a payload resource entry missing the field or a programmatically built PayloadDefinition that never set it.

Common situations: New payload definitions authored without choosing an interpretation environment; copying an existing payload and dropping enum lines; proto/enum renames leaving the field at its default value.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• Parse payload does not have a name.
• Validation type not supported.
• No payload implemented for
• No valid payload input is entered.
• Invalid network service

AI-assisted analysis of google/tsunami-security-scanner@363ba87b35 (2026-09-13). Data as JSON: /api/errors/ddab62de1ab1d889. Report an issue: GitHub.

Appendix: source

Thrown at plugin_server/py/plugin/payload/payload_utility.py:58

  payload_str = Path(_PATH).read_text()
  yaml_parser = yaml.YAML(typ='safe', pure=True)
  payload_dict = yaml_parser.load(payload_str)
  payload_library = json_format.ParseDict(payload_dict, pg.PayloadLibrary())
  return _validate_payloads([p for p in payload_library.payloads])


def _validate_payloads(
    payloads: list[pg.PayloadDefinition],
) -> list[pg.PayloadDefinition]:
  """Validate the pre-loaded payloads."""
  for payload in payloads:
    if not payload.HasField('name'):
      raise ValueError('Parse payload does not have a name.')
    if (
        payload.interpretation_environment
        is pg.PayloadGeneratorConfig.InterpretationEnvironment.INTERPRETATION_ENVIRONMENT_UNSPECIFIED
    ):
      raise ValueError(
          'Parse payload does not have an interpretation environment.'
      )
    if (
        payload.execution_environment
        is pg.PayloadGeneratorConfig.ExecutionEnvironment.EXECUTION_ENVIRONMENT_UNSPECIFIED
    ):
      raise ValueError('Parse payload does not have an execution environment.')
    if (
        pg.PayloadGeneratorConfig.VulnerabilityType.VULNERABILITY_TYPE_UNSPECIFIED
        in payload.vulnerability_type
    ):
      raise ValueError('Parse payload does not have a vulnerability type.')
    if not payload.HasField('payload_string'):
      raise ValueError('Parse payload does not have a payload string.')
    if bool(
        payload.uses_callback_server.ByteSize()
    ) and '$TSUNAMI_PAYLOAD_TOKEN_URL' not in str(payload.payload_string):
      raise ValueError(

View on GitHub (pinned to 363ba87b35)