{"record":{"id":"7082df23c50577eb","repo":"remix-run/remix","slug":"invalid-bypass-pattern-json-stringify-pattern-7082df","errorCode":null,"errorMessage":"invalid bypass pattern ${JSON.stringify(pattern)}: empty wildcards are not allowed","messagePattern":"invalid bypass pattern (.+?): empty wildcards are not allowed","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cop-middleware/src/lib/cop.ts","lineNumber":282,"sourceCode":"\nfunction parseBypassSegment(\n  pattern: string,\n  segment: string,\n  isLastSegment: boolean,\n): BypassSegment {\n  if (segment === '') {\n    throw new Error(\n      `invalid bypass pattern ${JSON.stringify(pattern)}: empty path segments are not allowed`,\n    )\n  }\n\n  if (!segment.startsWith('{') || !segment.endsWith('}')) {\n    return { type: 'static', value: segment }\n  }\n\n  let wildcardName = segment.slice(1, segment.length - 1)\n  if (wildcardName === '') {\n    throw new Error(\n      `invalid bypass pattern ${JSON.stringify(pattern)}: empty wildcards are not allowed`,\n    )\n  }\n\n  if (wildcardName === '$') {\n    throw new Error(\n      `invalid bypass pattern ${JSON.stringify(pattern)}: \"{$}\" is not supported in cop-middleware`,\n    )\n  }\n\n  if (wildcardName.endsWith('...')) {\n    if (!isLastSegment) {\n      throw new Error(\n        `invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards must be last`,\n      )\n    }\n\n    if (wildcardName.length === 3) {","sourceCodeStart":264,"sourceCodeEnd":300,"githubUrl":"https://github.com/remix-run/remix/blob/9696913134be3a4423513d2775f7b31d6917c049/packages/cop-middleware/src/lib/cop.ts#L264-L300","documentation":"parseBypassSegment throws when a wildcard segment is exactly '{}', i.e. an unnamed wildcard. Wildcards must have a name like {id} for the pattern to be meaningful and for downstream matching. An empty '{}' is treated as a malformed pattern.","triggerScenarios":"addInsecureBypassPattern('/users/{}') or any pattern containing a '{}' segment.","commonSituations":"Placeholder templates left unfilled; regex-based generation of patterns producing '{}' when the capture name is missing; typos deleting the wildcard name.","solutions":["Give the wildcard a name: '/users/{id}' instead of '/users/{}'","If any single segment should match, still name it, e.g. '/files/{name}'"],"exampleFix":"// before\ncop.addInsecureBypassPattern('/users/{}')\n// after\ncop.addInsecureBypassPattern('/users/{id}')","handlingStrategy":"validation","validationCode":"const segments = path.split('/')\nif (segments.some((s) => s === '{}')) throw new Error('empty wildcard in pattern')","typeGuard":"function isValidWildcardSegment(segment: string): boolean {\n  return !(segment.startsWith('{') && segment.endsWith('}') && segment.length === 2)\n}","tryCatchPattern":null,"preventionTips":["Fill template placeholders before registering patterns","Unit-test generated patterns"],"tags":["cop-middleware","bypass-pattern","wildcard","validation"],"backgroundTag":"invalid-path-pattern","analyzedSha":"9696913134be3a4423513d2775f7b31d6917c049","analyzedAt":"2026-08-27T19:55:01.024Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}