{"record":{"id":"bc513b2d4a90686e","repo":"crowdsecurity/crowdsec","slug":"invalid-path-regex-s-for-bot-entry-s-in-s","errorCode":null,"errorMessage":"invalid path regex '%s' for bot entry '%s' in %s: %w","messagePattern":"invalid path regex '(.+?)' for bot entry '(.+?)' in (.+?): %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/exprhelpers/botfile.go","lineNumber":77,"sourceCode":"\t\treturn fmt.Errorf(\"missing mandatory 'name' field in %s: %s\", filename, line)\n\t}\n\n\tif len(entry.IPs)+len(entry.Ranges)+len(entry.RDNS) == 0 {\n\t\treturn fmt.Errorf(\"bot entry '%s' in %s has no identity verification (need at least one of ips/ranges/rdns)\", entry.Name, filename)\n\t}\n\n\tvar err error\n\n\tif entry.UserAgent != \"\" {\n\t\tif entry.uaRegex, err = compileBotRegex(entry.UserAgent); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid user_agent regex for bot entry '%s' in %s: %w\", entry.Name, filename, err)\n\t\t}\n\t}\n\n\tfor _, p := range entry.Paths {\n\t\tre, err := compileBotRegex(p)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid path regex '%s' for bot entry '%s' in %s: %w\", p, entry.Name, filename, err)\n\t\t}\n\n\t\tentry.pathRegexes = append(entry.pathRegexes, re)\n\t}\n\n\tentry.ipSet = make(map[netip.Addr]struct{}, len(entry.IPs))\n\n\tfor _, ip := range entry.IPs {\n\t\taddr, err := netip.ParseAddr(ip)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid IP '%s' for bot entry '%s' in %s: %w\", ip, entry.Name, filename, err)\n\t\t}\n\n\t\tentry.ipSet[addr.Unmap()] = struct{}{}\n\t}\n\n\tfor _, r := range entry.Ranges {\n\t\tprefix, err := netip.ParsePrefix(r)","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/exprhelpers/botfile.go#L59-L95","documentation":"botFileInit compiles each element of the entry's optional \"paths\" array as a case-insensitive regex. This error is thrown when any individual path pattern fails regexp.Compile. Like the UA regex, paths are validated eagerly so a broken entry never reaches match time.","triggerScenarios":"A bots JSONL entry has a \"paths\" array where one element is an invalid Go RE2 regex, e.g. \"paths\":[\"/wp-login*\"] (invalid repetition after literal — actually valid as .*) — more precisely patterns like \"/admin(\" or \"\\\\\". The message names the offending pattern, entry name, and file.","commonSituations":"Writing URL paths with unescaped regex metacharacters (? in query strings, . matching any char, + in URLs); typos in hand-written patterns; porting PCRE path filters with unsupported RE2 constructs.","solutions":["Escape metacharacters in literal path text: \"/search\\?q=\" instead of \"/search?q=\", \"\\.php\" instead of \".php\".","Fix the syntax flaw the wrapped regexp/syntax error points to (unbalanced groups, dangling escapes, invalid repeat).","Remove lookaheads/backreferences — Go's RE2 does not support them; restructure the pattern.","Anchor patterns intentionally (^/admin) to avoid accidental broad matches once the regex compiles.","Pre-compile each pattern with regexp.Compile in a scratch test before adding it to the data file."],"exampleFix":"// before\n{\"name\":\"scanner\",\"ips\":[\"1.2.3.4\"],\"paths\":[\"/wp-admin?section=(\"]}\n// after\n{\"name\":\"scanner\",\"ips\":[\"1.2.3.4\"],\"paths\":[\"^/wp-admin\\\\?.*\"]}","handlingStrategy":"validation","validationCode":"for _, p := range entry.Paths {\n\tif _, err := regexp.Compile(\"(?i)\" + p); err != nil {\n\t\t// reject the entry before FileInit\n\t}\n}\nvalid := err == nil","typeGuard":null,"tryCatchPattern":"if err := exprhelpers.FileInit(botFile, \"bots\"); err != nil {\n\tif strings.Contains(err.Error(), \"invalid path regex\") {\n\t\tlog.Errorf(\"offending path pattern: %v\", err) // message echoes the pattern\n\t}\n\treturn err\n}","preventionTips":["Escape ?, ., +, ( in literal URL text within path patterns.","Anchor path regexes (^/admin) to keep matches precise.","Test each path pattern against sample URLs with regexp.MatchString before deployment.","Keep one pattern per array element; avoid overly complex combined patterns."],"tags":["go","regex","validation","data-files"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}