{"record":{"id":"b04ab1feda48087e","repo":"crowdsecurity/crowdsec","slug":"cannot-compile-variable-regexp-s-w","errorCode":null,"errorMessage":"cannot compile variable regexp %s: %w","messagePattern":"cannot compile variable regexp (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/appsec.go","lineNumber":1051,"sourceCode":"\t// on_challenge_submit hooks: same merge pattern; in-band only.\n\tonChallengeSubmitHooks := wc.OnChallengeSubmit\n\tif wc.InBand != nil {\n\t\tonChallengeSubmitHooks = append(onChallengeSubmitHooks, wc.InBand.OnChallengeSubmit...)\n\t}\n\n\tif ret.CompiledOnChallengeSubmit, err = buildHookList(ctx, onChallengeSubmitHooks, hookOnChallengeSubmit, patcher); err != nil {\n\t\treturn nil, err\n\t}\n\n\tif len(ret.CompiledOnChallengeSubmit) > 0 {\n\t\tpatcher.NeedWASMVM = true\n\t}\n\n\t// variable tracking\n\tfor _, variable := range wc.VariablesTracking {\n\t\tcompiledVariableRule, err := regexp.Compile(variable)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"cannot compile variable regexp %s: %w\", variable, err)\n\t\t}\n\n\t\tret.CompiledVariablesTracking = append(ret.CompiledVariablesTracking, compiledVariableRule)\n\t}\n\n\tret.NeedWASMVM = patcher.NeedWASMVM\n\n\treturn ret, nil\n}\n\n// processHooks runs a list of compiled hooks with the given environment.\n//\n// state, when non-nil, is consulted between rule iterations: if\n// state.HooksHalted is true (set by a terminal expr helper such as\n// RejectSubmission or the on_challenge_submit GrantChallengeCookie),\n// remaining rules in this phase are skipped. ProcessOnLoadRules passes\n// nil — it has no request state at all.\nfunc (w *AppsecRuntimeConfig) processHooks(hooks []Hook, env map[string]interface{}, hookType string, state *AppsecRequestState) error {","sourceCodeStart":1033,"sourceCodeEnd":1069,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/appsec.go#L1033-L1069","documentation":"Build() compiles each entry of VariablesTracking as a Go regexp to track specific WAF variables. If regexp.Compile rejects the pattern (invalid syntax), the build aborts with this error wrapping the regexp error. It is a config-authoring bug in the appsec-config YAML.","triggerScenarios":"An entry under variables_tracking: contains invalid regex syntax, e.g. unbalanced parentheses, a trailing `+`, or an invalid escape like `\\d` without proper quoting issues (Go RE2 rejects some PCRE constructs).","commonSituations":"Custom appsec-config with hand-written regex; copying a PCRE regex using lookaheads (`(?=...)`) which Go's RE2 does not support; accidental YAML unquoting mangling backslashes.","solutions":["Fix the regex syntax in variables_tracking; test it with a RE2-compatible checker (regex101 with Golang flavor)","Remove unsupported PCRE constructs (lookaheads/lookbehinds, backreferences) — Go regexp does not support them","Quote the YAML value properly so backslashes survive: use single quotes","Read the wrapped error position (`error parsing regexp: ...`) to locate the offending character"],"exampleFix":"// before\nvariables_tracking:\n  - \"(?<=foo)bar\"\n// after\nvariables_tracking:\n  - 'foobar'","handlingStrategy":"validation","validationCode":"for _, v := range cfg.VariablesTracking {\n    if _, err := regexp.Compile(v); err != nil {\n        return fmt.Errorf(\"invalid variables_tracking regex %q: %w\", v, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := buildAppsecRuntime(cfg); err != nil {\n    var reErr error\n    if strings.Contains(err.Error(), \"cannot compile variable regexp\") {\n        log.Fatalf(\"fix variables_tracking regex: %v\", err)\n    }\n    return err\n}","preventionTips":["Use Go/RE2 flavor when authoring regexes (no lookaheads, no backreferences)","Unit-test every custom regex with regexp.MustCompile in tests","Single-quote YAML values containing backslashes"],"tags":["appsec","regex","config"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}