[BUG] Invalid XPath extractor expressions compile successfully and are silently skipped
Is there an existing issue for this?
- I searched open and closed issues and pull requests for XPath and extractor validation. #7604 concerns absent/empty values; this report concerns a nonempty but invalid XPath expression.
Current Behavior
Extractor.CompileExtractors() accepts invalid XPath expressions such as //a[ and unknown-function(). When extraction runs, htmlquery.QueryAll / xmlquery.QueryAll returns an error and the extractor silently skips the expression. Unlike invalid regex, JSON or DSL expressions, the author gets no compilation error identifying the mistake.
Expected Behavior
Reject invalid XPath expressions during extractor compilation, including the offending expression and parser error in the diagnostic. Valid HTML and XML extraction should continue to work.
Steps To Reproduce
Inside the nuclei module, construct an extractor and compile it:
e := &extractors.Extractor{
Type: extractors.ExtractorTypeHolder{ExtractorType: extractors.XPathExtractor},
XPath: []string{"//a["},
}
fmt.Println(e.CompileExtractors()) // currently <nil>
fmt.Println(e.ExtractXPath(`<html><body><a>link</a></body></html>`)) // map[]This also occurs when an invalid expression follows a valid one, e.g. []string{"//a", "//p["}.
Environment
- OS: macOS / arm64
- Nuclei: dev at 66068dbe
- Go: go1.26.5
Anything else?
I reproduced the missing validation with regression tests: all three invalid-expression cases failed on the unmodified implementation because compilation returned nil. The fix uses the existing github.com/antchfx/xpath dependency's compiler and does not change extraction behavior.
Source: projectdiscovery/nuclei