{"record":{"id":"894d43c05924bec5","repo":"crowdsecurity/crowdsec","slug":"fail-to-apply-startipendipfilter-w","errorCode":null,"errorMessage":"fail to apply StartIpEndIpFilter: %w","messagePattern":"fail to apply StartIpEndIpFilter: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/database/decisionfilter.go","lineNumber":108,"sourceCode":"\t\t\toffset, err := strconv.Atoi(value[0])\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"invalid offset value: %w: %w\", err, InvalidFilter)\n\t\t\t}\n\n\t\t\tquery = query.Offset(offset)\n\t\tcase \"id_gt\":\n\t\t\tid, err := strconv.Atoi(value[0])\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"invalid id_gt value: %w: %w\", err, InvalidFilter)\n\t\t\t}\n\n\t\t\tquery = query.Where(decision.IDGT(id))\n\t\t}\n\t}\n\n\tquery, err = decisionIPFilter(query, contains, rng)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"fail to apply StartIpEndIpFilter: %w\", err)\n\t}\n\n\treturn query, nil\n}\n\nfunc decisionIPv4Filter(decisions *ent.DecisionQuery, contains bool, rng csnet.Range) (*ent.DecisionQuery, error) {\n\tif contains {\n\t\t// Decision contains {start_ip,end_ip}\n\t\treturn decisions.Where(decision.And(\n\t\t\tdecision.StartIPLTE(rng.Start.Addr),\n\t\t\tdecision.EndIPGTE(rng.End.Addr),\n\t\t\tdecision.IPSizeEQ(int64(rng.Size())))), nil\n\t}\n\n\t// Decision is contained within {start_ip,end_ip}\n\treturn decisions.Where(decision.And(\n\t\tdecision.StartIPGTE(rng.Start.Addr),\n\t\tdecision.EndIPLTE(rng.End.Addr),","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/decisionfilter.go#L90-L126","documentation":"applyDecisionFilter wraps the error returned by decisionIPFilter when building the IP/range predicates for the query fails — i.e. the parsed range could not be turned into SQL predicates (StartIp/EndIp filters), not that the range string itself was unparsable.","triggerScenarios":"A syntactically valid range that decisionIPFilter/decisionIPv4Filter/decisionIPv6Filter still cannot apply (e.g. internal predicate construction error, or an error propagated from the v4/v6 sub-filters while computing StartIp/EndIp bounds).","commonSituations":"Unusual but valid ranges (e.g. huge IPv6 blocks) hitting edge cases in range-to-bounds conversion; version skew between API layer and csnet range handling.","solutions":["Look at the wrapped inner error from decisionIPFilter for the root cause.","Retry with a narrower, conventional CIDR (e.g. /24 for IPv4) to rule out edge-case ranges.","Test the range with cscli or a small Go snippet calling csnet.NewRange plus the filter path.","Update crowdsec — version skew fixes for range handling appear over time."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"rng, err := csnet.NewRange(ipOrCIDR)\nif err != nil {\n    return fmt.Errorf(\"invalid range %q: %w\", ipOrCIDR, err)\n}\nif s := rng.Size(); s != 4 && s != 16 && s != 0 {\n    return fmt.Errorf(\"unsupported range size %d\", s)\n}","typeGuard":null,"tryCatchPattern":"q, err := applyDecisionFilter(query, filter)\nif err != nil {\n    if strings.Contains(err.Error(), \"StartIpEndIpFilter\") {\n        return fmt.Errorf(\"ip filter could not be applied: %w\", err)\n    }\n    return err\n}","preventionTips":["Pre-validate ranges with csnet.NewRange before filtering","Test unusual CIDR sizes in CI","Keep csnet/crowdsec versions aligned","Fall back to a broader conventional CIDR when exotic ranges fail"],"tags":["api","database","network","filter"],"backgroundTag":"invalid-query-parameter","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}