{"record":{"id":"22793de081daacdd","repo":"crowdsecurity/crowdsec","slug":"compilation-of-s-failed-w","errorCode":null,"errorMessage":"compilation of '%s' failed: %w","messagePattern":"compilation of '(.+?)' failed: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/alertcontext/alertcontext.go","lineNumber":39,"sourceCode":"const MaxContextValueLen = 4000\n\nvar alertContext atomic.Pointer[Context]\n\ntype Context struct {\n\tContextToSend         map[string][]string\n\tContextValueLen       int\n\tContextToSendCompiled map[string][]*vm.Program\n}\n\nfunc ValidateContextExpr(key string, expressions []string) error {\n\tfor _, expression := range expressions {\n\t\t_, err := expr.Compile(expression, exprhelpers.GetExprOptions(map[string]any{\n\t\t\t\"evt\":   &pipeline.Event{},\n\t\t\t\"match\": &pipeline.MatchedRule{},\n\t\t\t\"req\":   &http.Request{},\n\t\t})...)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"compilation of '%s' failed: %w\", expression, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc NewAlertContext(contextToSend map[string][]string, valueLength int) error {\n\tif valueLength == 0 {\n\t\tlog.Debugf(\"No console context value length provided, using default: %d\", MaxContextValueLen)\n\t\tvalueLength = MaxContextValueLen\n\t}\n\n\tif valueLength > MaxContextValueLen {\n\t\tlog.Debugf(\"Provided console context value length (%d) is higher than the maximum, using default: %d\", valueLength, MaxContextValueLen)\n\t\tvalueLength = MaxContextValueLen\n\t}\n\n\tac := Context{","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/alertcontext/alertcontext.go#L21-L57","documentation":"ValidateContextExpr compiles each user-supplied alert-context expression with expr-lang to make sure it is syntactically and semantically valid before it is stored and later evaluated at alert time. If expr.Compile rejects the expression (syntax error, unknown identifier, wrong types for evt/match/req), it throws 'compilation of '%s' failed'. The wrapped error pinpoints the position and nature of the problem.","triggerScenarios":"addContext or TestValidateContextExpr passes an expression string that fails expr.Compile: unbalanced parentheses, using a field that doesn't exist on evt/match/req, calling a method that isn't registered in exprhelpers, or invalid operator usage like evt.Meta.source_ip > 'abc'.","commonSituations":"Operators write context rules in alert_context.yaml or console config; typo in a field path (evt.Meta.sourc_ip); attempting to use an unsupported builtin; forgetting quotes on a string literal.","solutions":["Fix the expression per the wrapped expr error, which includes the exact position and reason","Validate field names against the event/alert structures (evt.Meta.*, match.*) and use expr's environment: evt is pipeline.Event, match is pipeline.MatchedRule, req is http.Request","Test expressions quickly with 'cscli explain' or a small Go test using TestValidateContextExpr patterns","Escape quotes correctly in YAML so the expression string isn't mangled before compilation"],"exampleFix":"# before\ncontext:\n  ip: evt.Meta.source_ip == # syntax error\n# after\ncontext:\n  ip: evt.Meta.source_ip","handlingStrategy":"validation","validationCode":"if err := alertcontext.ValidateContextExpr(exprs); err != nil {\n    return fmt.Errorf(\"invalid context expression: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := alertcontext.ValidateContextExpr(userExprs); err != nil {\n    var compErr *expr.Error\n    if errors.As(err, &compErr) {\n        log.Errorf(\"at %s: %v\", compErr.FormattedPosition(), compErr.Message)\n    }\n    return err\n}","preventionTips":["Run crowdsec -t (config test) after editing context expressions","Reference only evt/match/req fields that exist in pkg/types structs","Quote expressions properly in YAML (single quotes)","Keep a unit test validating shipped expressions (TestValidateContextExpr pattern)"],"tags":["expr","config","validation"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}