projectdiscovery/nuclei · error

empty filename

Error message

empty filename

What it means

The request target (second field of the raw request line) goes through urlutil.ParseURL with strict semantics; invalid percent-encoding, control characters, or an unparseable target fail as 'could not parse request URL'. This happens before the self-contained host policy check, so no request is attempted.

Source

Thrown at pkg/catalog/aws/catalog.go:86

			config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(accessKey, secretKey, "")),
			config.WithRegion(region))
		if err != nil {
			return err
		}

		c.svc = &s3svc{
			client: s3.NewFromConfig(cfg),
			bucket: "",
		}

		return nil
	}
}

// OpenFile downloads a file from S3 and returns the contents as an io.ReadCloser
func (c Catalog) OpenFile(filename string) (io.ReadCloser, error) {
	if filename == "" {
		return nil, errors.New("empty filename")
	}

	return c.svc.downloadKey(filename)
}

// GetTemplatePath looks for a target string performing a simple substring check
// against all S3 keys. If the input includes a wildcard (*) it is removed.
func (c Catalog) GetTemplatePath(target string) ([]string, error) {
	target = strings.ReplaceAll(target, "*", "")

	keys, err := c.svc.getAllKeys()
	if err != nil {
		return nil, err
	}

	var matches []string
	for _, key := range keys {
		if strings.Contains(key, target) {

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Percent-encode unsafe bytes in the target (%20 for spaces, valid %-sequences)
2. Wrap dynamic values with {{url_encode(...)}} in the template
3. Validate the template plus a sample target locally before a large run

Example fix

# before
GET /my file.txt HTTP/1.1
# after
GET /my%20file.txt HTTP/1.1

import "net/url"

func targetParses(target string) bool {
    _, err := url.Parse(target)
    return err == nil
}

When it happens

Trigger: Targets like /a%zz (bad escape), a path with an unencoded space, or a dynamic variable ({{path}}) rendering with characters that are invalid in a URL.

Common situations: Fuzzing payloads or scraped paths injected into the request line; templates assuming browser-lenient URL parsing.

Related errors

• response read size must be non-negative
• no new line found at the end of host header
• template threads must be at least 1
• probe concurrency must be at least 1
• cannot use unsafe with http fuzzing templates

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/af22711c68c7966d. Report an issue: GitHub.