projectdiscovery/nuclei · error

empty operators

Error message

empty operators

What it means

Returned by Compile in the file protocol when the request has no matchers and no extractors (IsEmpty() is true). Every nuclei protocol requires at least one operator, otherwise the file would be read and nothing evaluated against it. The error surfaces at template load/compile time, so the template is rejected before any scanning starts.

Source

Thrown at pkg/protocols/file/file.go:140

	"raw,body,all,data": "Raw contains the raw file contents",
}

// defaultDenylist contains common extensions to exclude
var defaultDenylist = []string{".3g2", ".3gp", ".arj", ".avi", ".axd", ".bmp", ".css", ".csv", ".deb", ".dll", ".doc", ".drv", ".eot", ".exe", ".flv", ".gif", ".gifv", ".h264", ".ico", ".iso", ".jar", ".jpeg", ".jpg", ".lock", ".m4a", ".m4v", ".map", ".mkv", ".mov", ".mp3", ".mp4", ".mpeg", ".mpg", ".msi", ".ogg", ".ogm", ".ogv", ".otf", ".pdf", ".pkg", ".png", ".ppt", ".psd", ".rm", ".rpm", ".svg", ".swf", ".sys", ".tif", ".tiff", ".ttf", ".vob", ".wav", ".webm", ".wmv", ".woff", ".woff2", ".xcf", ".xls", ".xlsx"}

// defaultArchiveDenyList contains common archive extensions to exclude
var defaultArchiveDenyList = []string{".7z", ".apk", ".gz", ".rar", ".tar.gz", ".tar", ".zip"}

// GetID returns the unique ID of the request if any.
func (request *Request) GetID() string {
	return request.ID
}

// Compile compiles the protocol request for further execution.
func (request *Request) Compile(options *protocols.ExecutorOptions) error {
	// if there are no matchers/extractors, we trigger an error as no operation would be performed on the template
	if request.IsEmpty() {
		return errors.New("empty operators")
	}
	compiled := &request.Operators
	compiled.ExcludeMatchers = options.ExcludeMatchers
	compiled.TemplateID = options.TemplateID
	if err := compiled.Compile(); err != nil {
		return errors.Wrap(err, "could not compile operators")
	}
	request.CompiledOperators = compiled

	// By default, use default max size if not defined
	switch {
	case request.MaxSize != "":
		maxSize, err := units.FromHumanSize(request.MaxSize)
		if err != nil {
			return errors.Wrap(err, "could not compile operators")
		}
		request.maxSize = maxSize
	case request.MaxSize == "no":

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Add at least one matcher (e.g. word/regex on file content) or extractor to the file request
2. Run `nuclei -t your-template.yaml -validate` to catch it before scanning
3. Check YAML indentation so matchers/extractors sit inside the file request block, not at template root

Example fix

# before
file:
  - extensions:
      - all

# after
file:
  - extensions:
      - all
    matchers:
      - type: word
        words:
          - "PRIVATE KEY"

// template-side check before executing
if len(req.Matchers) == 0 && len(req.Extractors) == 0 {
    return fmt.Errorf("file request %s has empty operators", req.ID)
}

When it happens

Trigger: A template with a `file:` protocol request block that lacks both a `matchers:` and an `extractors:` section. Also produced when YAML indentation accidentally places matchers at template top level instead of inside the requests block.

Common situations: Converting a grep/find one-liner into a file template and forgetting the matcher; indentation mistakes when hand-editing YAML; beginners assuming file presence alone is a detectable condition.

Related errors

• validation failed for these fields
• Invalid severity: %s
• Invalid extractor type: %s
• Invalid matcher type: %s
• unresolved variables found: %s

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/18596e4fe74afda6. Report an issue: GitHub.