{"record":{"id":"542cebb6cdd38177","repo":"epi052/feroxbuster","slug":"the-regex-matches-the-scan-will-never-start","errorCode":null,"errorMessage":"The regex '{}' matches {}; the scan will never start","messagePattern":"The regex '(.+?)' matches (.+?); the scan will never start","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/main.rs","lineNumber":186,"sourceCode":"                // ferox_scans gets deserialized scans added to it at program start if --resume-from\n                // is used, so scans that aren't marked complete still need to be scanned\n                if scan.is_complete() || matches!(scan.scan_type, ScanType::File) {\n                    // this one's already done, or it's not a directory, ignore it\n                    continue;\n                }\n\n                targets.push(scan.url().to_owned());\n            }\n        };\n    } else {\n        targets.push(handles.config.target_url.clone());\n    }\n\n    // remove footgun that arises if a --dont-scan value matches on a base url\n    for target in targets.iter_mut() {\n        for denier in &handles.config.regex_denylist {\n            if denier.is_match(target) {\n                bail!(\n                    \"The regex '{}' matches {}; the scan will never start\",\n                    denier,\n                    target\n                );\n            }\n        }\n        for denier in &handles.config.url_denylist {\n            if denier.as_str().trim_end_matches('/') == target.trim_end_matches('/') {\n                bail!(\n                    \"The url '{}' matches {}; the scan will never start\",\n                    denier,\n                    target\n                );\n            }\n        }\n\n        if !target.starts_with(\"http\") {\n            // --url hackerone.com","sourceCodeStart":168,"sourceCodeEnd":204,"githubUrl":"https://github.com/epi052/feroxbuster/blob/1f595dab5c76858d5a14fbc47dabf2563d729c62/src/main.rs#L168-L204","documentation":"get_targets performs a footgun check: for each target it tests every regex in the --dont-scan (regex_denylist) set, and if a denylist regex matches the base target itself, the entire scan would be filtered out, so it bails immediately. This prevents users from launching scans that can never scan anything.","triggerScenarios":"A --dont-scan regex matches the base target string, e.g. ferox -u https://example.com --dont-scan example — the deny regex matches the root target so no URLs would ever be scanned.","commonSituations":"Users add a deny pattern meant to exclude a subdirectory or a parameter string but accidentally include the domain or a broad token (like the hostname, 'http', or '.com') that also matches the base URL.","solutions":["Rewrite the --dont-scan regex so it does not match the base target (e.g. anchor it: example.com/admin/ instead of example)","Escape regex metacharacters if the intent was a literal match","Remove the offending denylist entry and rely on narrower patterns","Test the regex against the base URL in a regex tester before running"],"exampleFix":"// before\nferox -u https://example.com --dont-scan example\n// after\nferox -u https://example.com --dont-scan example.com/logout","handlingStrategy":"validation","validationCode":"denylist.forEach(r => { if (new RegExp(r).test(targetUrl)) console.error(`dont-scan regex '${r}' matches target ${targetUrl}`); });","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Anchor dont-scan regexes to subpaths, never broad tokens","Escape literal dots and metacharacters in deny patterns","Test regexes against the base URL before running"],"tags":["configuration","regex","cli","footgun"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"1f595dab5c76858d5a14fbc47dabf2563d729c62","analyzedAt":"2026-09-13T19:33:06.208Z","contentChangedAt":"2026-09-13T19:33:06.208Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}