shadow1ng/fscan · error

webscan_expression_eval_failed

webscan_expression_eval_failed

Error message

webscan_expression_eval_failed: %w

What it means

The compiled CEL program was created but program.Eval(params) returned a runtime error, wrapped as webscan_expression_eval_failed. Compilation succeeded, so this is a runtime problem: missing params keys, type errors during evaluation, nil dereference on map fields, or a custom function panicking/returning an error.

Source

Thrown at webscan/lib/Eval.go:184

		ast, issues := env.Compile(expression)
		if issues.Err() != nil {
			return nil, fmt.Errorf("%s: %w", i18n.GetText("webscan_expression_compile_failed"), issues.Err())
		}

		var err error
		program, err = env.Program(ast, GetBaseProgramOptions()...)
		if err != nil {
			return nil, fmt.Errorf("%s: %w", i18n.GetText("webscan_program_create_failed"), err)
		}

		if cache != nil {
			cache[expression] = program
		}
	}

	result, _, err := program.Eval(params)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("webscan_expression_eval_failed"), err)
	}

	return result, nil
}

// URLTypeToString 将 TargetURL 结构体转换为字符串
func URLTypeToString(u *UrlType) string {
	var builder strings.Builder

	// 处理 scheme 部分
	if u.Scheme != "" {
		builder.WriteString(u.Scheme)
		builder.WriteByte(':')
	}

	// 处理 host 部分
	if u.Scheme != "" || u.Host != "" {
		if u.Host != "" || u.Path != "" {

View on GitHub (pinned to 95cc12e753)

Solutions

1. Read the wrapped err — cel-go names the failing operation/variable
2. Provide all declared variables in params before evaluation
3. Make POC expressions defensive: use has() / 'key' in map checks before indexing
4. Verify custom function argument types match what the expression passes

Example fix

// before (indexes missing header, runtime error)
"response.headers['Server'] contains 'Tomcat'"
// after (guard with membership test)
"('Server' in response.headers) && response.headers['Server'].contains('Tomcat')"

for _, key := range requiredVars(expr) {
    if _, ok := params[key]; !ok {
        return fmt.Errorf("missing param %q for expression", key)
    }
}

result, err := Evaluate(expr, params)
if err != nil {
    log.Printf("eval failed for %q: %v", expr, err)
    return nil // treat expression failure as "poc not matched"
}

When it happens

Trigger: Evaluate/EvaluateCached with params lacking a variable the expression references, indexing a missing key on a map-typed param (e.g. response.headers missing), comparing incompatible runtime types, calling a custom function with wrong argument types.

Common situations: Expressions referencing response.body when the response had no body, header lookups on missing headers, string-to-int comparisons, running a POC against a target where an expected field is absent (e.g. no Server header).

Understand the failure class

Background: "invalid response format", "malformed payload", "missing data field": when an API returns 200 but the response shape is wrong — this error's family across 23 libraries.

Related errors

• webscan_cel_env_not_initialized
• webscan_expression_compile_failed
• webscan_program_create_failed
• webscan_poc_convert_failed
• webscan_poc_file_read_failed

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/0b387101d82dd19f. Report an issue: GitHub.