{"record":{"id":"7cd510f1b287aa4a","repo":"gohugoio/hugo","slug":"failed-to-compile-whitelist-pattern-q-w","errorCode":null,"errorMessage":"failed to compile whitelist pattern %q: %w","messagePattern":"failed to compile whitelist pattern %q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/security/whitelist.go","lineNumber":91,"sourceCode":"\t\t\tacceptSome = true\n\t\t\tpatternsStrings = append(patternsStrings, ps)\n\t\t}\n\t}\n\n\tif !acceptSome {\n\t\treturn Whitelist{acceptNone: true}, nil\n\t}\n\n\tvar allow, deny []*regexp.Regexp\n\tfor _, p := range patternsStrings {\n\t\traw := p\n\t\tnegate := strings.HasPrefix(p, hglob.NegationPrefix)\n\t\tif negate {\n\t\t\traw = p[len(hglob.NegationPrefix):]\n\t\t}\n\t\tre, err := regexp.Compile(raw)\n\t\tif err != nil {\n\t\t\treturn Whitelist{}, fmt.Errorf(\"failed to compile whitelist pattern %q: %w\", p, err)\n\t\t}\n\t\tif negate {\n\t\t\tdeny = append(deny, re)\n\t\t} else {\n\t\t\tallow = append(allow, re)\n\t\t}\n\t}\n\n\treturn Whitelist{allow: allow, deny: deny, patternsStrings: patternsStrings}, nil\n}\n\n// MustNewWhitelist creates a new Whitelist from zero or more patterns and panics on error.\nfunc MustNewWhitelist(patterns ...string) Whitelist {\n\tw, err := NewWhitelist(patterns...)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\treturn w","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/gohugoio/hugo/blob/52c9bd7908b4d02d4d0ff8f82a888834d6ee10d2/config/security/whitelist.go#L73-L109","documentation":"config/security.NewWhitelist (config/security/whitelist.go:89) compiles each supplied pattern as a Go regexp, after optionally stripping a '!' negation prefix (hglob.NegationPrefix). This wraps regexp.Compile failure with the offending pattern. Whitelists back the security config allow/deny lists (e.g. security.exec.allow, security.http.urls).","triggerScenarios":"Setting a security allow/deny list entry with invalid regexp syntax such as an unclosed character class '[a-z', a dangling quantifier '*', or an unbalanced parenthesis.","commonSituations":"Typing a glob-style pattern where a regex is expected (e.g. '*.js' instead of '.*\\.js'); copy-pasting a pattern from a glob-based tool; unescaped metacharacters meant literally.","solutions":["Validate each whitelist pattern with regexp.Compile in isolation before adding it to config.","Remember patterns are regex, not globs: use '.*' for 'any', and escape literal dots with '\\.'.","If you intended a negation, prefix with '!' (hglob.NegationPrefix) only once.","Strip the pattern down to the simplest form and re-add complexity once it compiles."],"exampleFix":"// before\n[security.exec]\nallow = ['^.*$', '*.sh']  // '*.sh' is glob syntax -> invalid regex\n\n// after\n[security.exec]\nallow = ['^.*$', '.*\\.sh$']","handlingStrategy":"validation","validationCode":"func ValidateWhitelistPatterns(patterns ...string) error {\n    for _, p := range patterns {\n        raw := strings.TrimPrefix(p, \"!\") // hglob.NegationPrefix\n        if _, err := regexp.Compile(raw); err != nil {\n            return fmt.Errorf(\"pattern %q: %w\", p, err)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"w, err := security.NewWhitelist(patterns...)\nif err != nil {\n    return fmt.Errorf(\"security whitelist: %w\", err)\n}","preventionTips":["Remember whitelist entries are regex, not globs.","Escape literal dots and other metacharacters.","Lint security.* lists in CI with regexp.Compile."],"tags":["config","security","regex"],"backgroundTag":null,"analyzedSha":"52c9bd7908b4d02d4d0ff8f82a888834d6ee10d2","analyzedAt":"2026-08-09T21:49:36.660Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}