{"record":{"id":"391381c7e58c6494","repo":"golang/go","slug":"parsing-cgo-s-disallow-v","errorCode":null,"errorMessage":"parsing $CGO_%s_DISALLOW: %v","messagePattern":"parsing \\$CGO_(.+?)_DISALLOW: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/work/security.go","lineNumber":384,"sourceCode":"\nfunc checkFlags(name, source string, list []string, invalid, valid []*lazyregexp.Regexp, validNext []string, checkOverrides bool) error {\n\t// Let users override rules with $CGO_CFLAGS_ALLOW, $CGO_CFLAGS_DISALLOW, etc.\n\tvar (\n\t\tallow    *regexp.Regexp\n\t\tdisallow *regexp.Regexp\n\t)\n\tif checkOverrides {\n\t\tif env := cfg.Getenv(\"CGO_\" + name + \"_ALLOW\"); env != \"\" {\n\t\t\tr, err := regexp.Compile(env)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"parsing $CGO_%s_ALLOW: %v\", name, err)\n\t\t\t}\n\t\t\tallow = r\n\t\t}\n\t\tif env := cfg.Getenv(\"CGO_\" + name + \"_DISALLOW\"); env != \"\" {\n\t\t\tr, err := regexp.Compile(env)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"parsing $CGO_%s_DISALLOW: %v\", name, err)\n\t\t\t}\n\t\t\tdisallow = r\n\t\t}\n\t}\n\nArgs:\n\tfor i := 0; i < len(list); i++ {\n\t\targ := list[i]\n\t\tif disallow != nil && disallow.FindString(arg) == arg {\n\t\t\tgoto Bad\n\t\t}\n\t\tif allow != nil && allow.FindString(arg) == arg {\n\t\t\tcontinue Args\n\t\t}\n\t\tfor _, re := range invalid {\n\t\t\tif re.FindString(arg) == arg { // must be complete match\n\t\t\t\tgoto Bad\n\t\t\t}","sourceCodeStart":366,"sourceCodeEnd":402,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/work/security.go#L366-L402","documentation":"Thrown by checkFlags when the CGO_<NAME>_DISALLOW environment variable (e.g. CGO_CFLAGS_DISALLOW, CGO_LDFLAGS_DISALLOW) holds a string that fails regexp.Compile. DISALLOW is the user-side blocklist for cgo flags; a parse error means the blocklist cannot be applied and the build aborts rather than silently allowing everything.","triggerScenarios":"Set `CGO_CFLAGS_DISALLOW=(unbalanced` in the environment and run a cgo build that reaches the general compiler-flag checker with checkOverrides=true. regexp.Compile returns an error, which is wrapped into this message.","commonSituations":"A misplaced parenthesis in a security-blocklist regexp; environment exported from a templating system that stripped a closing bracket; migrating a sed/awk pattern into a Go regexp without RE2 restrictions.","solutions":["Correct the regexp to be RE2-valid (balanced grouping, no backreferences).","Validate with `regexp.Compile` in a scratch `go run` before exporting.","Unset the variable if unused: `unset CGO_CFLAGS_DISALLOW`.","Keep the blocklist minimal and well-tested."],"exampleFix":"// before\n// export CGO_CFLAGS_DISALLOW=(-D.*\n\n// after\n// export CGO_CFLAGS_DISALLOW=-D[A-Z_]+","handlingStrategy":"validation","validationCode":"// Validate CGO_CFLAGS_DISALLOW regexp\nif v := os.Getenv(\"CGO_CFLAGS_DISALLOW\"); v != \"\" {\n    if _, err := regexp.Compile(v); err != nil {\n        log.Fatalf(\"fix CGO_CFLAGS_DISALLOW: %v\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep DISALLOW regexps simple and balanced.","Validate in CI before invoking go build.","Unset blocklists you no longer use."],"tags":["go-toolchain","cgo","flags","regex","environment"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}