projectdiscovery/nuclei · error

missing url in request response

Error message

missing url in request response

What it means

RequestResponse.UnmarshalJSON requires every JSON input entry to carry a top-level "url" string; this error fires when the key is absent. Note the value must also survive urlutil.ParseAbsoluteURL (absolute, with host) or unmarshalling fails with a different error.

Source

Thrown at pkg/input/types/http.go:136

	}
	m["request"] = reqBin
	respBin, err := json.Marshal(rr.Response)
	if err != nil {
		return nil, err
	}
	m["response"] = respBin
	return json.Marshal(m)
}

// UnmarshalJSON unmarshals the request response from json
func (rr *RequestResponse) UnmarshalJSON(data []byte) error {
	var m map[string]json.Message
	if err := json.Unmarshal(data, &m); err != nil {
		return err
	}
	urlStrRaw, ok := m["url"]
	if !ok {
		return fmt.Errorf("missing url in request response")
	}
	var urlStr string
	if err := json.Unmarshal(urlStrRaw, &urlStr); err != nil {
		return err
	}
	parsed, err := urlutil.ParseAbsoluteURL(urlStr, false)
	if err != nil {
		return err
	}
	rr.URL = *parsed

	reqBin, ok := m["request"]
	if ok {
		var req HttpRequest
		if err := json.Unmarshal(reqBin, &req); err != nil {
			return err
		}
		rr.Request = &req

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Add "url": "https://host/path" to every object in the input file
2. Validate the file before scanning, e.g. jq 'map(select(.url == null))' should return []
3. If the input is really just URLs, use list mode (-im list) which has no such requirement

Example fix

# before
{"request": {"method": "GET", "headers": {}, "body": ""}}

# after
{"url": "https://example.com/api", "request": {"method": "GET", "headers": {}, "body": ""}}

# jq preflight over the input file
jq -e 'type == "array" and all(.[]; has("url") and (.url | type == "string") and (.url | startswith("http")))' input.json

If using the SDK, wrap json.Unmarshal on each entry; on this exact message skip and log the offending entry index rather than aborting the whole provider build.

When it happens

Trigger: Feeding a JSON input file where an object has "request" and/or "response" but no "url" key; renaming the field (e.g. "URI") or misplacing it one nesting level too deep.

Common situations: Hand-edited request-response JSON files; converting Burp/proxy exports and dropping the url field; entries where url is present but empty string (then ParseAbsoluteURL fails instead).

Related errors

• object can be a key:value or a string
• downloaded content is not valid JSON: %w
• downloaded content is neither valid JSON nor YAML: %w
• could not create request: no request in request response
• failed to read method line: %s

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/e515c0541f3c8d47. Report an issue: GitHub.