{"record":{"id":"174267901bfaf713","repo":"crowdsecurity/crowdsec","slug":"invalid-on-success-for-s-hook-s","errorCode":null,"errorMessage":"invalid 'on_success' for %s hook : %s","messagePattern":"invalid 'on_success' for (.+?) hook : (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/appsec.go","lineNumber":832,"sourceCode":"\t\t\twc.OutOfBandOptions.DisableBodyInspection = true\n\t\t}\n\n\t\tif wc.OutOfBand.Options.RequestBodyInMemoryLimit != nil {\n\t\t\twc.OutOfBandOptions.RequestBodyInMemoryLimit = wc.OutOfBand.Options.RequestBodyInMemoryLimit\n\t\t}\n\n\t\twc.VariablesTracking = append(wc.VariablesTracking, wc.OutOfBand.VariablesTracking...)\n\t\twc.OutOfBand.VariablesTracking = nil\n\t}\n}\n\n// buildHookList validates and compiles a list of hooks of the given stage.\nfunc buildHookList(ctx context.Context, hooks []Hook, stage hookStage, patcher *appsecExprPatcher) ([]Hook, error) {\n\tvar compiled []Hook\n\n\tfor _, hook := range hooks {\n\t\tif hook.OnSuccess != \"\" && hook.OnSuccess != \"continue\" && hook.OnSuccess != \"break\" {\n\t\t\treturn nil, fmt.Errorf(\"invalid 'on_success' for %s hook : %s\", stage, hook.OnSuccess)\n\t\t}\n\n\t\tif err := hook.Build(ctx, stage, patcher); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to build %s hook : %w\", stage, err)\n\t\t}\n\n\t\tcompiled = append(compiled, hook)\n\t}\n\n\treturn compiled, nil\n}\n\n// buildPhaseHooks compiles pre_eval / post_eval / on_match hook lists into a\n// PhaseHooks. phaseName is only used to wrap errors (\"\" for the shared section).\nfunc buildPhaseHooks(ctx context.Context, phaseName string, pre, post, onMatch []Hook, patcher *appsecExprPatcher) (PhaseHooks, error) {\n\tvar (\n\t\tout PhaseHooks\n\t\terr error","sourceCodeStart":814,"sourceCodeEnd":850,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/appsec.go#L814-L850","documentation":"buildHookList validates each hook's on_success field before compiling it; the only permitted values are the empty string, 'continue', and 'break'. Any other string aborts the build of that hook stage with this message naming the stage and the bad value. It is an enum-validation error on hook control-flow configuration.","triggerScenarios":"An appsec-config or rules YAML sets on_success: \"Continue\", \"stop\", \"return\", or any value other than continue/break on a hook (pre_eval, post_eval, or on_match), triggering Build/buildHookList during AppsecConfig build.","commonSituations":"Typo or wrong casing in on_success (values are lowercase and case-sensitive); copying on_success semantics from other WAF engines that use different keywords; misunderstanding that on_success is optional (omit it entirely instead of inventing values).","solutions":["Change on_success to exactly 'continue' or 'break' (lowercase), or remove the key to use the default","Check the stage name in the error to find which phase section of the YAML has the bad value","Grep your appsec-configs/rules for on_success to catch all occurrences at once"],"exampleFix":"// before\n- filter: \"...\"\n  on_success: stop\n// after\n- filter: \"...\"\n  on_success: break","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use only continue/break, lowercase","Grep configs during review"],"tags":["appsec","config","enum"],"backgroundTag":"invalid-enum-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}