shadow1ng/fscan · error

webscan_err_invalid_url

Error message

webscan_err_invalid_url

What it means

ErrInvalidURL (message text localized via i18n key webscan_err_invalid_url): guard in web-scan URL normalization when url.Parse fails or the parsed URL has an empty host, meaning the target string is not a usable absolute URL for the web scanner.

Source

Thrown at webscan/web_scan.go:36

	"github.com/shadow1ng/fscan/common"
	"github.com/shadow1ng/fscan/common/config"
	"github.com/shadow1ng/fscan/common/i18n"
	"github.com/shadow1ng/fscan/webscan/lib"
)

// 常量定义
const (
	protocolHTTP     = "http://"
	protocolHTTPS    = "https://"
	yamlExt          = ".yaml"
	ymlExt           = ".yml"
	defaultTimeout   = 30 * time.Second
	concurrencyLimit = 10 // 并发加载POC的限制
)

// 错误定义
var (
	ErrInvalidURL    = errors.New(i18n.GetText("webscan_err_invalid_url"))
	ErrEmptyTarget   = errors.New(i18n.GetText("webscan_err_empty_target"))
	ErrPocNotFound   = errors.New(i18n.GetText("webscan_err_poc_not_found"))
	ErrPocLoadFailed = errors.New(i18n.GetText("webscan_err_poc_load_failed"))
)

//go:embed pocs
var pocsFS embed.FS

// pocStore 按 PocPath 缓存已加载的 POC 集合，支持多 session 使用不同 POC 路径
type pocStore struct {
	mu    sync.Mutex
	cache map[string][]*lib.Poc // key: pocPath（空字符串表示内嵌 POC）
}

var globalPocStore = &pocStore{cache: make(map[string][]*lib.Poc)}

// WebScan 执行Web漏洞扫描
func WebScan(ctx context.Context, info *common.HostInfo, cfg *common.Config, session *common.ScanSession) {

View on GitHub (pinned to 95cc12e753)

Solutions

1. Supply a full URL with scheme and host, e.g. http://target:8080/
2. Pre-validate user-supplied URL lists before scanning
3. Strip entries that fail URL parsing and report them separately

When it happens

Trigger: Thrown at webscan/web_scan.go:36 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/79603db2cc49edeb. Report an issue: GitHub.