{"record":{"id":"3c2a06aa2fc0178a","repo":"trufflesecurity/trufflehog","slug":"s-is-not-a-valid-regex-error-received-v","errorCode":null,"errorMessage":"%s is not a valid regex, error received: %v","messagePattern":"(.+?) is not a valid regex, error received: (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/detectors/jdbc/jdbc.go","lineNumber":39,"sourceCode":"\nfunc New(opts ...func(*Scanner)) *Scanner {\n\tscanner := &Scanner{\n\t\tignorePatterns: []regexp.Regexp{},\n\t}\n\tfor _, opt := range opts {\n\t\topt(scanner)\n\t}\n\n\treturn scanner\n}\n\nfunc WithIgnorePattern(ignoreStrings []string) func(*Scanner) {\n\treturn func(s *Scanner) {\n\t\tvar ignorePatterns []regexp.Regexp\n\t\tfor _, ignoreString := range ignoreStrings {\n\t\t\tignorePattern, err := regexp.Compile(ignoreString)\n\t\t\tif err != nil {\n\t\t\t\tpanic(fmt.Sprintf(\"%s is not a valid regex, error received: %v\", ignoreString, err))\n\t\t\t}\n\t\t\tignorePatterns = append(ignorePatterns, *ignorePattern)\n\t\t}\n\n\t\ts.ignorePatterns = ignorePatterns\n\t}\n}\n\n// Ensure the Scanner satisfies the interface at compile time.\nvar _ detectors.Detector = (*Scanner)(nil)\nvar _ detectors.CustomFalsePositiveChecker = (*Scanner)(nil)\n\nvar (\n\t// Matches typical JDBC connection strings.\n\t// The terminal character class additionally excludes () and & to avoid\n\t// capturing surrounding delimiters (e.g. \"(jdbc:…)\" or \"…&user=x&\").\n\tkeyPat = regexp.MustCompile(`(?i)jdbc:[\\w]{3,10}:[^\\s\"'<>,{}[\\]]{10,511}[^\\s\"'<>,{}[\\]()&]`)\n)","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/trufflesecurity/trufflehog/blob/bcfcf73aaf4759d4dadc2783177c245a02792318/pkg/detectors/jdbc/jdbc.go#L21-L57","documentation":"TruffleHog's JDBC detector exposes WithIgnorePattern as a functional option: it takes a slice of regex strings used to suppress false-positive JDBC connection strings, compiles each one with Go's stdlib regexp package, and panics with this message as soon as regexp.Compile fails. The panic fires when New(...) applies the option, i.e. at scanner construction time, before any scanning happens. The message embeds both the offending pattern and the compiler's reason, so the panic text is the diagnosis.","triggerScenarios":"Calling jdbc.New(jdbc.WithIgnorePattern([]string{...})) where at least one string is not compilable by Go's RE2-based regexp: unbalanced '(' or '[', a trailing backslash, a repetition operator with nothing to repeat (e.g. '*.example.com' or '+foo'), an invalid named group like '(?P<>', or a reverse character range like '[z-a]'. The panic happens inside the option closure that New() invokes, so the crash occurs on the New() call line, not during FromData().","commonSituations":"Embedding trufflehog as a library and feeding ignore patterns from CLI flags, env vars, or CI config without pre-validation; copying glob patterns from .gitignore-style configs ('*.internal.example.com') into a regex field; under- or over-escaping in interpreted string literals (\"\\.\" vs \"\\\\.\" vs \"\\\\\\\\.\"); hand-editing a pattern list and shipping without running the detector tests (TestJdbc_FromDataWithIgnorePattern exercises this option).","solutions":["Read the panic string: it names the exact bad pattern and the compiler error (e.g. 'missing closing )'); fix that specific pattern first.","If the pattern was copied from a glob/PCRE tool, convert it: '*.internal.example.com' -> `.*\\.internal\\.example\\.com`, and escape regex metacharacters ( . + ? ( ) [ ] { } | ^ $ ).","Write patterns as Go raw string literals (backticks) so you write one backslash instead of two and avoid escaping mistakes in interpreted strings.","Validate the whole pattern list with regexp.Compile at your config boundary and return a normal error, instead of letting the library panic at startup.","If patterns are fully untrusted and you cannot validate upstream, wrap the New() call in a defer/recover to convert the panic into an error."],"exampleFix":"// before\ns := jdbc.New(jdbc.WithIgnorePattern([]string{\"jdbc:mysql://*.stage.example.com\"})) // panics: '*' has nothing to repeat\n\n// after\ns := jdbc.New(jdbc.WithIgnorePattern([]string{`jdbc:mysql://.*\\.stage\\.example\\.com`}))","handlingStrategy":"validation","validationCode":"import (\n\t\"fmt\"\n\t\"regexp\"\n)\n\n// Run BEFORE jdbc.New(jdbc.WithIgnorePattern(...)). Uses stdlib regexp,\n// the same engine the jdbc detector compiles with.\nfunc compileIgnorePatterns(patterns []string) ([]*regexp.Regexp, error) {\n\tcompiled := make([]*regexp.Regexp, 0, len(patterns))\n\tfor _, p := range patterns {\n\t\tre, err := regexp.Compile(p)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid jdbc ignore pattern %q: %w\", p, err)\n\t\t}\n\t\tcompiled = append(compiled, re)\n\t}\n\treturn compiled, nil\n}\n\nif _, err := compileIgnorePatterns(cfg.JdbcIgnorePatterns); err != nil {\n\treturn err // fail config validation, never reach jdbc.New()\n}","typeGuard":"// True when the string is safely passable to jdbc.WithIgnorePattern.\nfunc isValidIgnorePattern(pattern string) bool {\n\t_, err := regexp.Compile(pattern)\n\t\treturn err == nil\n}","tryCatchPattern":"// Last-resort conversion of the constructor panic into an error.\nfunc newJdbcScanner(opts ...func(*jdbc.Scanner)) (sc *jdbc.Scanner, err error) {\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\terr = fmt.Errorf(\"jdbc scanner construction failed: %v\", r)\n\t\t}\n\t}()\n\treturn jdbc.New(opts...), nil\n}","preventionTips":["Compile-check every ignore pattern with regexp.Compile at config load time and return an error there — never let raw config strings reach New() untested.","Remember the jdbc detector uses Go stdlib regexp (RE2 syntax): no lookaheads, lookbehinds, or backreferences are accepted.","Write patterns as raw string literals (backticks) so each regex escape is one backslash, not two.","Do not paste globs (*.example.com) or PCRE into the pattern list; convert wildcards to .* and escape metacharacters.","Add a unit test that compiles your pattern list (mirror TestJdbc_FromDataWithIgnorePattern) so bad patterns fail CI, not production."],"tags":["go","regex","panic","configuration","trufflehog","jdbc","re2"],"backgroundTag":null,"analyzedSha":"bcfcf73aaf4759d4dadc2783177c245a02792318","analyzedAt":"2026-08-15T22:39:44.547Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}