kgretzky/evilginx2 · error

js_inject: missing `script` field

Error message

js_inject: missing `script` field

What it means

Each `js_inject` entry must define `script`, the JavaScript source injected into matched responses. The entry's `script` field was nil, so validation fails — injecting nothing would be meaningless. This is the final mandatory js_inject field before the domains/paths lists are parameter-substituted.

Source

Thrown at core/phishlet.go:475

				sf.WithParams = &[]string{}
			}

			for n := range *sf.Mimes {
				(*sf.Mimes)[n] = p.paramVal((*sf.Mimes)[n])
			}
			p.addSubFilter(p.paramVal(*sf.Hostname), p.paramVal(*sf.Sub), p.paramVal(*sf.Domain), *sf.Mimes, p.paramVal(*sf.Search), p.paramVal(*sf.Replace), sf.RedirectOnly, *sf.WithParams)
		}
	}
	if fp.JsInject != nil {
		for _, js := range *fp.JsInject {
			if js.TriggerDomains == nil {
				return fmt.Errorf("js_inject: missing `trigger_domains` field")
			}
			if js.TriggerPaths == nil {
				return fmt.Errorf("js_inject: missing `trigger_paths` field")
			}
			if js.Script == nil {
				return fmt.Errorf("js_inject: missing `script` field")
			}
			for n := range *js.TriggerDomains {
				(*js.TriggerDomains)[n] = p.paramVal((*js.TriggerDomains)[n])
			}
			for n := range *js.TriggerPaths {
				(*js.TriggerPaths)[n] = p.paramVal((*js.TriggerPaths)[n])
			}
			err := p.addJsInject(*js.TriggerDomains, *js.TriggerPaths, js.TriggerParams, p.paramVal(*js.Script))
			if err != nil {
				return err
			}
		}
	}
	if fp.Intercept != nil {
		for _, ic := range *fp.Intercept {
			var err error
			var body, mime string
			if ic.Domain == nil {

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add `script: '<javascript>'` or a literal block (`script: |` followed by indented JS) to the entry
2. If using a multiline block, indent the script body consistently under `script: |` so YAML parses it as a non-empty string
3. Reload the phishlet and confirm no further validation errors are reported

Example fix

// before
js_inject:
  - trigger_domains: ['auth.example.com']
    trigger_paths: ['/login']
// after
js_inject:
  - trigger_domains: ['auth.example.com']
    trigger_paths: ['/login']
    script: "console.log('injected')"

for i, js in enumerate(cfg.get('js_inject') or []):
    if js.get('script') in (None, ''):
        raise ValueError(f"js_inject[{i}]: missing `script` field")

func validJsInject(js JsInject) bool { return js.Script != nil }

When it happens

Trigger: A `js_inject:` entry omits the `script:` key (or its value line was deleted); core/phishlet.go's `if js.Script == nil` check fires during phishlet validation.

Common situations: Creating a placeholder js_inject block intending to fill the script later; YAML multiline script (| or >) block badly indented so the key parses as nil; copy/paste losing the script body.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• js_inject: missing `trigger_domains` field
• js_inject: missing `trigger_paths` field
• sub_filters: missing `domain` field
• sub_filters: missing `mimes` field
• sub_filters: missing `search` field

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/abc2f8ae8995219b. Report an issue: GitHub.