projectdiscovery/nuclei · error

attribute can't be empty

Error message

attribute can't be empty

What it means

In the extract/GetAttribute code path, when the extraction target is `attribute` the template must name which DOM attribute to read via the `attribute` arg. An empty value is rejected before element.Attribute is called, because reading an unnamed attribute is meaningless.

Source

Thrown at pkg/protocols/headless/engine/page_actions.go:838

	if err = element.ScrollIntoView(); err != nil {
		return errors.Wrap(err, errCouldNotScroll)
	}

	target, err := p.getActionArg(act, "target")
	if err != nil {
		return err
	}

	switch target {
	case "attribute":
		attribute, err := p.getActionArg(act, "attribute")
		if err != nil {
			return err
		}

		if attribute == "" {
			return errors.New("attribute can't be empty")
		}

		attrValue, err := element.Attribute(attribute)
		if err != nil {
			return errors.Wrap(err, "could not get attribute")
		}

		if act.Name != "" {
			out[act.Name] = *attrValue
		}
	default:
		text, err := element.Text()
		if err != nil {
			return errors.Wrap(err, "could not get element text node")
		}

		if act.Name != "" {
			out[act.Name] = text

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Add the attribute arg naming the DOM attribute to read (e.g. attribute: href, value, data-token)
2. Run `nuclei -t tpl.yaml -validate` to catch structurally valid but incomplete steps early
3. Check indentation so the arg lives inside the same action block

Example fix

# before
- action: extract
  by: attribute
  name: token

# after
- action: extract
  by: attribute
  attribute: data-token
  name: token

// when assembling steps programmatically
if act.ActionType == engine.ActionExtract {
    if strings.TrimSpace(act.GetArg("attribute")) == "" && act.GetArg("by") == "attribute" {
        return errors.New("extract-by-attribute requires the attribute arg")
    }
}

When it happens

Trigger: A headless extract action like `action: extract ... by: attribute` (or getattribute) with the `attribute:` arg missing or set to an empty string in the step.

Common situations: Copying an extract-by-text example and changing only the `by` field; YAML indentation that places `attribute:` outside the step's args; template edits that delete the arg line.

Related errors

• payload concurrency must be at least 1
• Invalid action type: %s
• event not recognized
• please set custom_user_agent in the template
• no navigation action found

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/a9ccee081a0f702f. Report an issue: GitHub.