{"record":{"id":"4aa12fa000d5f370","repo":"stamparm/maltrail","slug":"suspicious-http-request-regexes-must-carry-a-code-execution","errorCode":null,"errorMessage":"SUSPICIOUS_HTTP_REQUEST_REGEXES must carry a 'code execution' entry","messagePattern":"SUSPICIOUS_HTTP_REQUEST_REGEXES must carry a 'code execution' entry","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"sensor/src/settings.rs","lineNumber":272,"sourceCode":"        let ua_src = build_suspicious_ua_regex(&root);\n        let suspicious_ua = match pyre::build(&ua_src) {\n            Ok(re) => Some(re),\n            Err(e) => {\n                crate::ceprintln!(\"[!] unable to compile SUSPICIOUS_UA_REGEX ({e}); user-agent heuristic disabled\");\n                None\n            }\n        };\n\n        let mut suspicious_http_request = Vec::with_capacity(SUSPICIOUS_HTTP_REQUEST_REGEXES.len());\n        for (desc, src) in SUSPICIOUS_HTTP_REQUEST_REGEXES {\n            // Python: re.search(regex, value, re.I | re.DOTALL)\n            suspicious_http_request.push((*desc, pyre::compile(&format!(\"(?is){src}\"))));\n        }\n        let code_execution = SUSPICIOUS_HTTP_REQUEST_REGEXES\n            .iter()\n            .find(|(desc, _)| desc.contains(\"code execution\"))\n            .map(|(_, src)| pyre::compile(&format!(\"(?is){src}\")))\n            .expect(\"SUSPICIOUS_HTTP_REQUEST_REGEXES must carry a 'code execution' entry\");\n\n        let mut suspicious_http_path = Vec::with_capacity(SUSPICIOUS_HTTP_PATH_REGEXES.len());\n        for (desc, src) in SUSPICIOUS_HTTP_PATH_REGEXES {\n            suspicious_http_path.push((*desc, pyre::compile(&format!(\"(?i){src}\"))));\n        }\n\n        Statics {\n            f_crlf: memchr::memmem::Finder::new(\"\\r\\n\").into_owned(),\n            f_crlf2: memchr::memmem::Finder::new(\"\\r\\n\\r\\n\").into_owned(),\n            f_sp_http: memchr::memmem::Finder::new(\" HTTP/\").into_owned(),\n            f_http_slash: memchr::memmem::Finder::new(\"HTTP/\").into_owned(),\n            f_host: memchr::memmem::Finder::new(\"\\r\\nHost:\").into_owned(),\n            f_user_agent: memchr::memmem::Finder::new(\"\\r\\nUser-Agent:\").into_owned(),\n            f_content_type: memchr::memmem::Finder::new(\"\\r\\nContent-Type:\").into_owned(),\n            f_intranet: memchr::memmem::Finder::new(\".intranet.\").into_owned(),\n\n            root,\n            valid_dns_name: pyre::compile(VALID_DNS_NAME_REGEX),","sourceCodeStart":254,"sourceCodeEnd":290,"githubUrl":"https://github.com/stamparm/maltrail/blob/77cfb06d7606506d101bbcec0786c77166c4255e/sensor/src/settings.rs#L254-L290","documentation":"Statics::build requires one entry of SUSPICIOUS_HTTP_REQUEST_REGEXES whose description contains \"code execution\", because that entry is compiled separately into the code_execution regex used by detection logic. If the constant table lacks such a description, .expect panics with this message. This is a data-shape invariant on the shipped regex table, not a runtime condition.","triggerScenarios":"Running settings::init()/Statics::build() after SUSPICIOUS_HTTP_REQUEST_REGEXES was edited so that no (desc, src) pair has a description containing the substring \"code execution\", making .find(|(desc, _)| desc.contains(\"code execution\")) return None.","commonSituations":"Renaming or rewording a regex description in the constant table; removing the code-execution entry during a cleanup; refactoring the table into a config file where the description no longer matches exactly.","solutions":["Restore or re-add an entry in SUSPICIOUS_HTTP_REQUEST_REGEXES whose description contains \"code execution\"","Replace the fragile substring .find with a keyed lookup (e.g. match on an enum or exact tag field)","Add a unit test asserting the code-execution entry exists so edits fail in CI, not at startup"],"exampleFix":"// before\nlet code_execution = SUSPICIOUS_HTTP_REQUEST_REGEXES.iter()\n    .find(|(desc, _)| desc.contains(\"code execution\"))\n    .map(|(_, src)| pyre::compile(&format!(\"(?is){src}\")))\n    .expect(\"SUSPICIOUS_HTTP_REQUEST_REGEXES must carry a 'code execution' entry\");\n// after\nlet code_execution = SUSPICIOUS_HTTP_REQUEST_REGEXES.iter()\n    .find(|(desc, _)| desc.contains(\"code execution\"))\n    .map(|(_, src)| pyre::compile(&format!(\"(?is){src}\")))\n    .unwrap_or_else(|| panic!(\"code execution regex missing; have: {:?}\", SUSPICIOUS_HTTP_REQUEST_REGEXES.iter().map(|(d, _)| *d).collect::<Vec<_>>()));","handlingStrategy":"validation","validationCode":"assert!(SUSPICIOUS_HTTP_REQUEST_REGEXES.iter().any(|(d, _)| d.contains(\"code execution\")), \"code execution regex entry missing\");","typeGuard":"fn has_code_execution_entry(table: &[(&str, &str)]) -> bool { table.iter().any(|(d, _)| d.contains(\"code execution\")) }","tryCatchPattern":"let code_execution = find_code_execution().expect(\"SUSPICIOUS_HTTP_REQUEST_REGEXES must carry a 'code execution' entry\");","preventionTips":["Add a compile-time/startup unit test asserting required table entries exist","Key entries by an explicit tag instead of substring description matching","Review regex-table edits with the invariant in mind"],"tags":["rust","panic","config-validation","regex"],"backgroundTag":"schema-validation-failed","analyzedSha":"77cfb06d7606506d101bbcec0786c77166c4255e","analyzedAt":"2026-09-13T03:50:16.010Z","contentChangedAt":"2026-09-13T03:50:16.010Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}