What causes "force_post: missing or empty `path` field" in kgretzky/evilginx2?

Add a non-empty `path` key to every force_post operation in the phishlet YAML

force_post: missing or empty `path` field

Error message

force_post: missing or empty `path` field

What it means

This error is thrown during phishlet validation when a `force_post` operation entry lacks the `path` field entirely or has an empty string as its value. The phishlet parser requires each force_post operation to specify the URL path it applies to; the `path` is later compiled into a regexp after parameter substitution. Since the field is a pointer (*string), nil means the key was absent from the YAML config, which makes the operation unmatchable.

Source

Thrown at core/phishlet.go:700

			}
			o.search, err = regexp.Compile(p.paramVal(*cp.Search))
			if err != nil {
				return err
			}
			o.tp = cp.Type
			if o.tp == "" {
				o.tp = "post"
			}
			o.key_s = p.paramVal(*cp.Key)
			p.custom = append(p.custom, o)
		}
	}

	if fp.ForcePosts != nil {
		for _, op := range *fp.ForcePosts {
			var err error
			if op.Path == nil || *op.Path == "" {
				return fmt.Errorf("force_post: missing or empty `path` field")
			}
			if op.Type == nil || *op.Type != "post" {
				return fmt.Errorf("force_post: unknown type - only 'post' is currently supported")
			}
			if op.Force == nil || len(*op.Force) == 0 {
				return fmt.Errorf("force_post: missing or empty `force` field")
			}

			fpf := ForcePost{}
			fpf.path, err = regexp.Compile(p.paramVal(*op.Path))
			if err != nil {
				return err
			}
			fpf.tp = *op.Type

			if op.Search != nil {
				for _, op_s := range *op.Search {
					if op_s.Key == nil {

View on GitHub (pinned to 4c0988a1d9)

Solutions

Add a non-empty `path` key to every force_post operation in the phishlet YAML
Fix YAML indentation so the `path` key is nested under the correct force_post list item
Correct key-name typos (e.g. `paths`/`url` -> `path`)
Run the phishlet through `phishlets edit <name>` or a YAML linter to spot structural mistakes

Example fix

# before
force_post:
  - type: post
    force:
      - key: password
        value: '123456'
# after
force_post:
  - path: '/login'
    type: post
    force:
      - key: password
        value: '123456'

Defensive patterns

Strategy: validation

Validate before calling

for i, op := range forcePosts {
    if op.Path == nil || strings.TrimSpace(*op.Path) == "" {
        return fmt.Errorf("force_post[%d]: `path` is required and must be non-empty", i)
    }
}

Type guard

func hasPath(op ForcePostOp) bool { return op.Path != nil && *op.Path != "" }

Prevention

Always include `path` in every force_post entry
Validate phishlet YAML with a linter before loading
Keep a canonical example phishlet and copy its force_post schema
Use `phishlets edit` instead of hand-editing raw files

When it happens

Trigger: Calling phishlet validation/loading (e.g. p.Validate()) on a phishlet whose YAML contains a `force_post` list element without a `path` key, or with `path: ''`.

Common situations: Hand-edited phishlet files copied from older or broken examples; typos like `paths:` instead of `path:`; YAML indentation mistakes that drop the key into a different mapping; refactoring a force_post block and accidentally deleting the path line.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/233509604e2e4bd2. Report an issue: GitHub.