{"record":{"id":"62ade8896906b212","repo":"valyala/fasthttp","slug":"cannot-parse-r-q-w","errorCode":null,"errorMessage":"cannot parse r=%q: %w","messagePattern":"cannot parse r=%q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"expvarhandler/expvar.go","lineNumber":61,"sourceCode":"\t\t\t\tfmt.Fprintf(ctx, \",\\n\")\n\t\t\t}\n\t\t\tfirst = false\n\t\t\tfmt.Fprintf(ctx, \"\\t%q: %s\", kv.Key, kv.Value)\n\t\t}\n\t})\n\tfmt.Fprintf(ctx, \"\\n}\\n\")\n\n\tctx.SetContentType(\"application/json; charset=utf-8\")\n}\n\nfunc getExpvarRegexp(ctx *fasthttp.RequestCtx) (*regexp.Regexp, error) {\n\tr := string(ctx.QueryArgs().Peek(\"r\"))\n\tif r == \"\" {\n\t\treturn defaultRE, nil\n\t}\n\trr, err := regexp.Compile(r)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot parse r=%q: %w\", r, err)\n\t}\n\treturn rr, nil\n}\n","sourceCodeStart":43,"sourceCodeEnd":65,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/expvarhandler/expvar.go#L43-L65","documentation":"fasthttpproxy's expvar handler accepts a query parameter r as a regexp to filter exported variables. If regexp.Compile fails on that value, the handler returns this wrapped error, quoting the invalid pattern and the underlying regexp parse error.","triggerScenarios":"Requesting /debug/vars?r=... with a syntactically invalid regular expression, e.g. r=[abc or r=* or r=(?P< unclosed group.","commonSituations":"Hand-typing filter patterns in a browser, dynamically building the r param from user input without escaping, copy-paste truncation of a pattern.","solutions":["Fix the r query parameter to be a valid Go regexp","Escape special characters with regexp.QuoteMeta when building the URL programmatically","Simplify the pattern (use plain substrings that need no metacharacters)","Validate with regexp.Compile client-side before issuing the request"],"exampleFix":"// before\nurl := \"/debug/vars?r=\" + rawUserFilter // r=\"[abc\"\n// after\nurl := \"/debug/vars?r=\" + url.QueryEscape(regexp.QuoteMeta(rawUserFilter))","handlingStrategy":"validation","validationCode":"if _, err := regexp.Compile(rParam); err != nil {\n    http.Error(w, \"invalid r parameter\", http.StatusBadRequest)\n    return\n}","typeGuard":"func validRegex(s string) (*regexp.Regexp, bool) {\n    re, err := regexp.Compile(s)\n    return re, err == nil\n}","tryCatchPattern":"re, err := getExpvarRegexp(ctx)\nif err != nil {\n    ctx.Error(fasthttp.StatusBadRequest, \"invalid r parameter\")\n    return\n}","preventionTips":["Escape user input with regexp.QuoteMeta before putting it in r","URL-encode the query parameter","Expose a documented set of preset filters instead of free-form regexps"],"tags":["go","regexp","expvar","query-param"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}