{"record":{"id":"977b902de0048d8a","repo":"crowdsecurity/crowdsec","slug":"unable-to-run-appsec-s-filter-s-w","errorCode":null,"errorMessage":"unable to run appsec %s filter %s : %w","messagePattern":"unable to run appsec (.+?) filter (.+?) : %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/appsec.go","lineNumber":1081,"sourceCode":"//\n// state, when non-nil, is consulted between rule iterations: if\n// state.HooksHalted is true (set by a terminal expr helper such as\n// RejectSubmission or the on_challenge_submit GrantChallengeCookie),\n// remaining rules in this phase are skipped. ProcessOnLoadRules passes\n// nil — it has no request state at all.\nfunc (w *AppsecRuntimeConfig) processHooks(hooks []Hook, env map[string]interface{}, hookType string, state *AppsecRequestState) error {\n\thas_match := false\n\n\tfor _, rule := range hooks {\n\t\tif state != nil && state.HooksHalted {\n\t\t\tw.Logger.Debugf(\"hooks halted by a terminal action; skipping remaining %s rules\", hookType)\n\t\t\tbreak\n\t\t}\n\n\t\tif rule.FilterExpr != nil {\n\t\t\toutput, err := exprhelpers.Run(rule.FilterExpr, env, w.Logger, w.Logger.Level >= log.DebugLevel)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"unable to run appsec %s filter %s : %w\", hookType, rule.Filter, err)\n\t\t\t}\n\n\t\t\tswitch t := output.(type) {\n\t\t\tcase bool:\n\t\t\t\tif !t {\n\t\t\t\t\tw.Logger.Debugf(\"filter didnt match\")\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\tdefault:\n\t\t\t\tw.Logger.Errorf(\"Filter must return a boolean, can't filter\")\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\thas_match = true\n\t\t}\n\n\t\tfor _, applyExpr := range rule.ApplyExpr {\n\t\t\to, err := exprhelpers.Run(applyExpr, env, w.Logger, w.Logger.Level >= log.DebugLevel)","sourceCodeStart":1063,"sourceCodeEnd":1099,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/appsec.go#L1063-L1099","documentation":"During hook evaluation (on_request/on_response/pre_eval), each rule's FilterExpr is an expr-lang expression executed with exprhelpers.Run. If evaluation itself errors (bad syntax compiled past validation, missing variable, wrong return type at runtime), this error wraps it and aborts the hook stage for the request.","triggerScenarios":"Rule filter referencing an undefined variable/function in the env; expression raising a runtime error (e.g. type error on nil map access); malformed expression that passed compile but fails at eval.","commonSituations":"Custom hook expression using a typo'd variable name; expression written against an older appsec env schema after an upgrade; filter accessing request fields absent for that request type.","solutions":["Fix the filter expression in the hook config, verifying every variable against the appsec eval env (request, tx, etc.)","Test the expression with `cscli explain` or a small expr snippet before deploying","Check the wrapped error for the exact variable/operation that failed","Upgrade crowdsec if the expression uses a newer env field added in a recent version"],"exampleFix":"// before (hook filter)\nfilter: request.url.contains('\n// after\nfilter: request.url.Path != '' && request.Method == 'POST'","handlingStrategy":"try-catch","validationCode":"expr, err := expr.Compile(filter, expr.Env(appsecEnv{}))\nif err != nil {\n    return fmt.Errorf(\"bad hook filter %q: %w\", filter, err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := exprhelpers.Run(rule.FilterExpr, env, logger, false); err != nil {\n    logger.Errorf(\"hook filter %q failed: %v — fix or remove the rule\", rule.Filter, err)\n    return // or fall back to default allow/deny policy\n}","preventionTips":["Compile-time validate hook filters with expr.Env at config load","Reference only documented appsec env variables in filters","Re-validate custom filters after every crowdsec upgrade"],"tags":["appsec","expr","rules"],"backgroundTag":"expression-evaluation-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}