{"record":{"id":"b592014368a97998","repo":"crowdsecurity/crowdsec","slug":"unable-to-compile-whitelist-expression-s-v","errorCode":null,"errorMessage":"unable to compile whitelist expression '%s' : %v","messagePattern":"unable to compile whitelist expression '(.+?)' : (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/whitelist.go","lineNumber":137,"sourceCode":"\t\tn.Whitelist.B_Ips = append(n.Whitelist.B_Ips, addr)\n\t\tn.Logger.Debugf(\"adding ip %s to whitelists\", addr)\n\t}\n\n\tfor _, v := range n.Whitelist.Cidrs {\n\t\ttnet, err := netip.ParsePrefix(v)\n\t\tif err != nil {\n\t\t\treturn false, fmt.Errorf(\"parsing whitelist: %w\", err)\n\t\t}\n\t\tn.Whitelist.B_Cidrs = append(n.Whitelist.B_Cidrs, tnet)\n\t\tn.Logger.Debugf(\"adding cidr %s to whitelists\", tnet)\n\t}\n\n\tfor _, filter := range n.Whitelist.Exprs {\n\t\tvar err error\n\t\texpression := &ExprWhitelist{}\n\t\texpression.Filter, err = expr.Compile(filter, exprhelpers.GetExprOptions(map[string]any{\"evt\": &pipeline.Event{}})...)\n\t\tif err != nil {\n\t\t\treturn false, fmt.Errorf(\"unable to compile whitelist expression '%s' : %v\", filter, err)\n\t\t}\n\t\tn.Whitelist.B_Exprs = append(n.Whitelist.B_Exprs, expression)\n\t\tn.Logger.Debugf(\"adding expression %s to whitelists\", filter)\n\t}\n\treturn n.ContainsWLs(), nil\n}\n\nfunc (n *Node) bumpWhitelistMetric(counter *prometheus.CounterVec, p *pipeline.Event) {\n\t// better safe than sorry\n\tacquisType := p.Line.Labels[\"type\"]\n\tif acquisType == \"\" {\n\t\tacquisType = \"unknown\"\n\t}\n\n\tlabels := prometheus.Labels{\n\t\t\"source\":      p.Line.Src,\n\t\t\"type\":        p.Line.Module,\n\t\t\"name\":        n.Name,","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/whitelist.go#L119-L155","documentation":"CompileWLs compiles each `whitelist: expression:` entry with the expr language; a syntactically or semantically invalid expression (unknown field, type error) is reported as \"unable to compile whitelist expression\". Expressions run against the event (evt) at parse time, so they must compile against the evt/pipeline.Event environment.","triggerScenarios":"expr.Compile(filter, ...) failing during CompileWLs — typo in evt fields, unbalanced brackets, comparing incompatible types, or referencing an undeclared variable in a whitelist `expression:` entry.","commonSituations":"Copy-pasted expression referencing fields the parsed event never sets (e.g. evt.Parsed.src_user); expr syntax errors like missing quotes; upgrading crowdsec changes available evt fields, breaking an old custom expression.","solutions":["Fix the expression per the expr error (line/column are included in the wrapped %v); test it with `cscli explain` or against a sample event","Verify the referenced fields exist in the parsed event (run crowdsec with parser debug to dump evt.Parsed)","Escape strings with single quotes and check bracket/paren balance","After crowdsec upgrades, re-validate custom whitelist expressions against the current pipeline.Event schema"],"exampleFix":"// before\nexpression: evt.Parsed.source_ip == \"1.2.3.4\" && evt\n// after\nexpression: evt.Parsed.source_ip == '1.2.3.4'","handlingStrategy":"validation","validationCode":"import \"github.com/expr-lang/expr\"\nfunc validWLExprs(exprs []string) error {\n  for _, e := range exprs {\n    if _, err := expr.Compile(e); err != nil {\n      return fmt.Errorf(\"whitelist expr %q invalid: %w\", e, err)\n    }\n  }\n  return nil\n}","typeGuard":null,"tryCatchPattern":"ok, err := node.CompileWLs()\nif err != nil {\n  if strings.Contains(err.Error(), \"unable to compile whitelist expression\") {\n    log.Fatalf(\"fix whitelist expression named in error: %v\", err)\n  }\n  return err\n}","preventionTips":["Test expressions with `cscli explain` on real events before deploying","Only reference fields confirmed present in evt.Parsed/evt.Enriched","Use single quotes for strings and check expr docs for type rules","Re-validate expressions after crowdsec upgrades"],"tags":["crowdsec","whitelist","expr","config","expression"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}