{"record":{"id":"c612fdefaff63bdd","repo":"cloudflare/cloudflared","slug":"rule-d-has-an-invalid-regex","errorCode":null,"errorMessage":"Rule #%d has an invalid regex","messagePattern":"Rule #(.+?) has an invalid regex","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/ingress.go","lineNumber":344,"sourceCode":"\t\t\treturn Ingress{}, err\n\t\t}\n\n\t\tisCatchAllRule := (r.Hostname == \"\" || r.Hostname == \"*\") && r.Path == \"\"\n\t\tpunycodeHostname := \"\"\n\t\tif !isCatchAllRule {\n\t\t\tpunycode, err := idna.Lookup.ToASCII(r.Hostname)\n\t\t\t// Don't provide the punycode hostname if it is the same as the original hostname\n\t\t\tif err == nil && punycode != r.Hostname {\n\t\t\t\tpunycodeHostname = punycode\n\t\t\t}\n\t\t}\n\n\t\tvar pathRegexp *Regexp\n\t\tif r.Path != \"\" {\n\t\t\tvar err error\n\t\t\tregex, err := regexp.Compile(r.Path)\n\t\t\tif err != nil {\n\t\t\t\treturn Ingress{}, errors.Wrapf(err, \"Rule #%d has an invalid regex\", i+1)\n\t\t\t}\n\t\t\tpathRegexp = &Regexp{Regexp: regex}\n\t\t}\n\n\t\trules[i] = Rule{\n\t\t\tHostname:         r.Hostname,\n\t\t\tpunycodeHostname: punycodeHostname,\n\t\t\tService:          service,\n\t\t\tPath:             pathRegexp,\n\t\t\tHandlers:         handlers,\n\t\t\tConfig:           cfg,\n\t\t}\n\t}\n\treturn Ingress{Rules: rules, Defaults: defaults}, nil\n}\n\nfunc validateHostname(r config.UnvalidatedIngressRule, ruleIndex, totalRules int) error {\n\t// Ensure that the hostname doesn't contain port","sourceCodeStart":326,"sourceCodeEnd":362,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/ingress.go#L326-L362","documentation":"Each ingress rule may specify a 'path' regular expression used to match requests. validateIngress compiles it with regexp.Compile; if compilation fails, the error is wrapped with the rule number. The whole ingress config fails to parse.","triggerScenarios":"An ingress rule whose path is not a valid Go RE2 regex, e.g. '/users/(\\d+' (unbalanced group), '*' (missing operand), or unsupported lookahead ' (?=...)'.","commonSituations":"Porting regexes from PCRE-capable languages (JavaScript, Python) that use lookaheads/lookbehinds or backreferences unsupported by Go's RE2; unescaped special characters in hand-written YAML paths.","solutions":["Test the path pattern with Go's regexp.Compile (or regexpcheck tools) to find the syntax error reported in the wrapped inner error.","Escape special regex characters you intend literally, e.g. '\\.' instead of '.'.","Replace PCRE-only constructs (lookaheads, backreferences) with RE2-compatible patterns.","If you only want prefix matching, use a plain pattern like '^/api/' instead of complex regex."],"exampleFix":"// before\npath: /api/(?<version>v\\d+)/\n// after\npath: ^/api/(v[0-9]+)/","handlingStrategy":"validation","validationCode":"if r.Path != \"\" {\n    if _, err := regexp.Compile(r.Path); err != nil {\n        return fmt.Errorf(\"rule path %q is not a valid Go regex: %w\", r.Path, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"ing, err := ingress.ParseIngress(conf)\nif err != nil && strings.Contains(err.Error(), \"invalid regex\") {\n    return fmt.Errorf(\"fix the path regex in your ingress rules: %w\", err)\n}","preventionTips":["Test path patterns with a RE2-compatible playground before deploying.","Avoid lookaheads, lookbehinds, and backreferences — Go's RE2 does not support them.","Escape literal dots and slashes in paths.","Run `cloudflared tunnel ingress validate` after config changes."],"tags":["ingress","regex","config-validation"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}