Is there an existing issue for this?
Current Behavior
Extractor.CompileExtractors() accepts invalid XPath expressions such as //a[ and unknown-function(). When extraction runs, htmlquery.QueryAll / xmlquery.QueryAll returns an error and the extractor silently skips the expression. Unlike invalid regex, JSON or DSL expressions, the author gets no compilation error identifying the mistake.
Expected Behavior
Reject invalid XPath expressions during extractor compilation, including the offending expression and parser error in the diagnostic. Valid HTML and XML extraction should continue to work.
Steps To Reproduce
Inside the nuclei module, construct an extractor and compile it:
e := &extractors.Extractor{
Type: extractors.ExtractorTypeHolder{ExtractorType: extractors.XPathExtractor},
XPath: []string{"//a["},
}
fmt.Println(e.CompileExtractors()) // currently <nil>
fmt.Println(e.ExtractXPath(`<html><body><a>link</a></body></html>`)) // map[]This also occurs when an invalid expression follows a valid one, e.g. []string{"//a", "//p["}.
Environment
- OS: macOS / arm64
- Nuclei: dev at 66068db
- Go: go1.26.5
Anything else?
I reproduced the missing validation with regression tests: all three invalid-expression cases failed on the unmodified implementation because compilation returned nil. The fix uses the existing github.com/antchfx/xpath dependency's compiler and does not change extraction behavior.
Is there an existing issue for this?
Current Behavior
Extractor.CompileExtractors()accepts invalid XPath expressions such as//a[andunknown-function(). When extraction runs,htmlquery.QueryAll/xmlquery.QueryAllreturns an error and the extractor silently skips the expression. Unlike invalid regex, JSON or DSL expressions, the author gets no compilation error identifying the mistake.Expected Behavior
Reject invalid XPath expressions during extractor compilation, including the offending expression and parser error in the diagnostic. Valid HTML and XML extraction should continue to work.
Steps To Reproduce
Inside the nuclei module, construct an extractor and compile it:
This also occurs when an invalid expression follows a valid one, e.g.
[]string{"//a", "//p["}.Environment
Anything else?
I reproduced the missing validation with regression tests: all three invalid-expression cases failed on the unmodified implementation because compilation returned nil. The fix uses the existing
github.com/antchfx/xpathdependency's compiler and does not change extraction behavior.