{"record":{"id":"596c8d5696319648","repo":"crowdsecurity/crowdsec","slug":"grantchallengecookie-accepts-at-most-one-ttl-argum","errorCode":null,"errorMessage":"GrantChallengeCookie accepts at most one TTL argument, got %d","messagePattern":"GrantChallengeCookie accepts at most one TTL argument, got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/waf_helpers.go","lineNumber":55,"sourceCode":"\t\t\tlogger.Warnf(\"unknown fingerprint log verbosity %q; falling back to info\", verbosity[0])\n\t\t}\n\n\t\treturn challenge.FingerprintLogInfo\n\t}\n}\n\n// parseChallengeCookieTTLArg interprets the optional TTL argument to the\n// GrantChallengeCookie expr helper. Zero variadic args means \"use the\n// runtime default\" and yields a nil override. A single non-empty string is\n// parsed with time.ParseDuration (e.g. \"1h\", \"30m\"). More than one TTL\n// argument or an unparseable value is reported as an error so hook authors\n// get a precise diagnostic at evaluation time rather than a silent fallback.\nfunc parseChallengeCookieTTLArg(ttl []string) (*time.Duration, error) {\n\tif len(ttl) == 0 {\n\t\treturn nil, nil\n\t}\n\tif len(ttl) > 1 {\n\t\treturn nil, fmt.Errorf(\"GrantChallengeCookie accepts at most one TTL argument, got %d\", len(ttl))\n\t}\n\tif ttl[0] == \"\" {\n\t\treturn nil, nil\n\t}\n\td, err := time.ParseDuration(ttl[0])\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid GrantChallengeCookie TTL %q: %w\", ttl[0], err)\n\t}\n\tif d <= 0 {\n\t\treturn nil, fmt.Errorf(\"GrantChallengeCookie TTL must be positive, got %s\", d)\n\t}\n\treturn &d, nil\n}\n\nfunc GetOnLoadEnv(w *AppsecRuntimeConfig) map[string]interface{} {\n\treturn map[string]interface{}{\n\t\t\"RemoveInBandRuleByID\":         w.DisableInBandRuleByID,\n\t\t\"RemoveInBandRuleByTag\":        w.DisableInBandRuleByTag,","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/waf_helpers.go#L37-L73","documentation":"The GrantChallengeCookie expr helper was called from a hook with more than one TTL argument. The helper accepts at most one optional TTL string; the count of extra arguments is reported so hook authors get a precise diagnostic at expression-evaluation time instead of a silent default.","triggerScenarios":"Thrown at pkg/appsec/waf_helpers.go:55 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the hook call: GrantChallengeCookie() or GrantChallengeCookie(\"30m\") — a single TTL string at most"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}