{"record":{"id":"7a49f2cd3eee93c7","repo":"trufflesecurity/trufflehog","slug":"s-is-not-a-valid-regex-error-received-v-7a49f2","errorCode":null,"errorMessage":"%s is not a valid regex, error received: %v","messagePattern":"(.+?) is not a valid regex, error received: (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/detectors/sqlserver/sqlserver.go","lineNumber":42,"sourceCode":"\nfunc New(opts ...func(*Scanner)) *Scanner {\n\tscanner := &Scanner{\n\t\tignorePatterns: []*regexp.Regexp{},\n\t}\n\tfor _, opt := range opts {\n\t\topt(scanner)\n\t}\n\n\treturn scanner\n}\n\nfunc WithIgnorePattern(ignoreStrings []string) func(*Scanner) {\n\treturn func(s *Scanner) {\n\t\tvar ignorePatterns []*regexp.Regexp\n\t\tfor _, ignoreString := range ignoreStrings {\n\t\t\tignorePattern, err := regexp.Compile(ignoreString)\n\t\t\tif err != nil {\n\t\t\t\tpanic(fmt.Sprintf(\"%s is not a valid regex, error received: %v\", ignoreString, err))\n\t\t\t}\n\t\t\tignorePatterns = append(ignorePatterns, ignorePattern)\n\t\t}\n\n\t\ts.ignorePatterns = ignorePatterns\n\t}\n}\n\n// Ensure the Scanner satisfies the interface at compile time.\nvar _ detectors.Detector = (*Scanner)(nil)\n\nvar (\n\t// SQLServer connection string is a semicolon delimited set of case-insensitive parameters which may go in any order.\n\tpattern = regexp.MustCompile(\"(?:\\n|`|'|\\\"| )?((?:[A-Za-z0-9_ ]+=[^;$'`\\\"$]+;?){3,})(?:'|`|\\\"|\\r\\n|\\n)?\")\n)\n\n// Keywords are used for efficiently pre-filtering chunks.\n// Use identifiers in the secret preferably, or the provider name.","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/trufflesecurity/trufflehog/blob/bcfcf73aaf4759d4dadc2783177c245a02792318/pkg/detectors/sqlserver/sqlserver.go#L24-L60","documentation":"TruffleHog's SQL Server detector takes WithIgnorePattern to filter out false-positive SQL Server connection strings (semicolon-delimited key=value chunks). This file compiles the patterns with github.com/wasilibs/go-re2 rather than stdlib regexp, so only RE2 syntax is accepted — lookarounds and backreferences are rejected even though many other engines accept them. When any supplied string fails compilation, the option panics with this message inside New(...), taking down the process before scanning starts. The message includes the bad pattern and the compiler's reason, pinpointing exactly what to fix.","triggerScenarios":"Calling sqlserver.New(sqlserver.WithIgnorePattern([]string{...})) where any entry is not valid RE2: e.g. '(?<=stage)\\\\.internal' (lookbehind), '(?=reporting)' (lookahead), 'Server=\\\\1' (backreference), or ordinary breakage like an unclosed '(' / '[' or a lone trailing backslash. The panic triggers during New() when the option closure runs, and unlike an error return it cannot be handled by checking err from New().","commonSituations":"Porting ignore patterns from PCRE-capable tooling (grep -P, VS Code find, other secret scanners) into a trufflehog-based pipeline; loading patterns from CI config or a management UI where nobody compile-tests them; escaping mistakes after the pattern passes through JSON/YAML and then a Go string literal; upgrading trufflehog versions where sqlserver switched from stdlib regexp to go-re2 and previously tolerated patterns now panic.","solutions":["Read the panic text: it names the failing pattern and gives the RE2 compile error; correct that entry first.","Strip unsupported constructs: replace '(?<=stage)db' with 'stagedb' (or 'stage.*db'), replace '(?=x)' lookaheads with literal '.*x' sequences, and remove backreferences.","Use raw string literals (backticks) for patterns so each regex escape is a single backslash.","Pre-compile every pattern with github.com/wasilibs/go-re2 before calling sqlserver.New() and reject bad config with a normal error instead of a startup panic.","For fully user-supplied patterns, wrap construction in defer/recover and log/reject the config."],"exampleFix":"// before\ns := sqlserver.New(sqlserver.WithIgnorePattern([]string{\"(?<=stage)\\\\.sqlserver\\\\.internal\"})) // panics: go-re2 has no lookbehind\n\n// after\ns := sqlserver.New(sqlserver.WithIgnorePattern([]string{`stage\\.sqlserver\\.internal`}))","handlingStrategy":"validation","validationCode":"import (\n\t\"fmt\"\n\tregexp \"github.com/wasilibs/go-re2\"\n)\n\n// Run BEFORE sqlserver.New(sqlserver.WithIgnorePattern(...)). Uses\n// go-re2, the exact engine this detector compiles with.\nfunc validateIgnorePatterns(patterns []string) error {\n\tfor _, p := range patterns {\n\t\tif _, err := regexp.Compile(p); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid sqlserver ignore pattern %q: %w\", p, err)\n\t\t}\n\t}\n\treturn nil\n}\n\nif err := validateIgnorePatterns(cfg.SqlServerIgnorePatterns); err != nil {\n\treturn err // reject config before constructing the scanner\n}","typeGuard":"// True when the string compiles under go-re2 (RE2), the engine the\n// sqlserver detector uses. PCRE-only patterns return false.\nfunc isValidRE2Pattern(pattern string) bool {\n\t_, err := regexp.Compile(pattern)\n\treturn err == nil\n}","tryCatchPattern":"// Last-resort conversion of the constructor panic into an error.\nfunc newSqlserverScanner(opts ...func(*sqlserver.Scanner)) (sc *sqlserver.Scanner, err error) {\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\terr = fmt.Errorf(\"sqlserver scanner construction failed: %v\", r)\n\t\t}\n\t}()\n\treturn sqlserver.New(opts...), nil\n}","preventionTips":["Compile-check patterns with github.com/wasilibs/go-re2 before calling New(); stdlib regexp.Compile catches most syntax errors but only go-re2 proves the pattern is RE2-legal.","Treat any pattern containing '(?', '(?<', '\\\\1'-style backreferences as suspect: these are the usual RE2 rejections.","Reject bad config at parse time with a normal error so a typo'd pattern fails one pipeline job instead of crashing the scan process.","Keep patterns in raw string literals (backticks) and account for extra escaping when they travel through YAML or JSON first.","Cover the pattern list with a unit test modeled on TestSqlServer_FromDataWithIgnorePattern so invalid regex fails CI."],"tags":["go","regex","re2","panic","configuration","trufflehog","sqlserver","lookbehind"],"backgroundTag":null,"analyzedSha":"bcfcf73aaf4759d4dadc2783177c245a02792318","analyzedAt":"2026-08-15T22:39:44.547Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}