kgretzky/evilginx2 · error

js_inject: missing `trigger_paths` field

Error message

js_inject: missing `trigger_paths` field

What it means

Each `js_inject` entry must define `trigger_paths`, the URL paths on which the script is injected. The entry's `trigger_paths` field was nil, so validation aborts. An empty-string path list entry can be used to match all paths, but the field itself must be present.

Source

Thrown at core/phishlet.go:472

				return fmt.Errorf("sub_filters: missing `replace` field")
			}
			if sf.WithParams == nil {
				sf.WithParams = &[]string{}
			}

			for n := range *sf.Mimes {
				(*sf.Mimes)[n] = p.paramVal((*sf.Mimes)[n])
			}
			p.addSubFilter(p.paramVal(*sf.Hostname), p.paramVal(*sf.Sub), p.paramVal(*sf.Domain), *sf.Mimes, p.paramVal(*sf.Search), p.paramVal(*sf.Replace), sf.RedirectOnly, *sf.WithParams)
		}
	}
	if fp.JsInject != nil {
		for _, js := range *fp.JsInject {
			if js.TriggerDomains == nil {
				return fmt.Errorf("js_inject: missing `trigger_domains` field")
			}
			if js.TriggerPaths == nil {
				return fmt.Errorf("js_inject: missing `trigger_paths` field")
			}
			if js.Script == nil {
				return fmt.Errorf("js_inject: missing `script` field")
			}
			for n := range *js.TriggerDomains {
				(*js.TriggerDomains)[n] = p.paramVal((*js.TriggerDomains)[n])
			}
			for n := range *js.TriggerPaths {
				(*js.TriggerPaths)[n] = p.paramVal((*js.TriggerPaths)[n])
			}
			err := p.addJsInject(*js.TriggerDomains, *js.TriggerPaths, js.TriggerParams, p.paramVal(*js.Script))
			if err != nil {
				return err
			}
		}
	}
	if fp.Intercept != nil {
		for _, ic := range *fp.Intercept {

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add `trigger_paths: ['<path>']` (e.g. `trigger_paths: ['/login']` or `['.*']` to match all) to the entry
2. Keep it a YAML list; the code later ranges over *js.TriggerPaths applying param substitution
3. Reload and fix any next missing field (script)

Example fix

// before
js_inject:
  - trigger_domains: ['auth.example.com']
    script: 'alert(1)'
// after
js_inject:
  - trigger_domains: ['auth.example.com']
    trigger_paths: ['/login']
    script: 'alert(1)'

for i, js in enumerate(cfg.get('js_inject') or []):
    tp = js.get('trigger_paths')
    if not isinstance(tp, list) or len(tp) == 0:
        raise ValueError(f"js_inject[{i}]: missing `trigger_paths` field")

func validJsInject(js JsInject) bool { return js.TriggerPaths != nil }

When it happens

Trigger: A `js_inject:` entry lacks the `trigger_paths:` key; core/phishlet.go's `if js.TriggerPaths == nil` check fires after trigger_domains passes.

Common situations: Assuming the script injects everywhere when trigger_paths is omitted (it does not — the key is required); YAML indentation dropping the key; copying a block from an older phishlet schema.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• js_inject: missing `trigger_domains` field
• js_inject: missing `script` field
• sub_filters: missing `domain` field
• sub_filters: missing `mimes` field
• sub_filters: missing `search` field

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/818f78591fb1c900. Report an issue: GitHub.