{"record":{"id":"c804fe038dbb2f5a","repo":"ffuf/ffuf","slug":"regexp-filter-or-matcher-fr-mr-invalid-valu","errorCode":null,"errorMessage":"Regexp filter or matcher (-fr / -mr): invalid value: %s","messagePattern":"Regexp filter or matcher \\(-fr / -mr\\): invalid value: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/filter/regex.go","lineNumber":20,"sourceCode":"\nimport (\n\t\"encoding/json\"\n\t\"fmt\"\n\t\"regexp\"\n\t\"strings\"\n\n\t\"github.com/ffuf/ffuf/v2/pkg/ffuf\"\n)\n\ntype RegexpFilter struct {\n\tValue    *regexp.Regexp\n\tvalueRaw string\n}\n\nfunc NewRegexpFilter(value string) (ffuf.FilterProvider, error) {\n\tre, err := regexp.Compile(value)\n\tif err != nil {\n\t\treturn &RegexpFilter{}, fmt.Errorf(\"Regexp filter or matcher (-fr / -mr): invalid value: %s\", value)\n\t}\n\treturn &RegexpFilter{Value: re, valueRaw: value}, nil\n}\n\nfunc (f *RegexpFilter) MarshalJSON() ([]byte, error) {\n\treturn json.Marshal(&struct {\n\t\tValue string `json:\"value\"`\n\t}{\n\t\tValue: f.valueRaw,\n\t})\n}\n\nfunc (f *RegexpFilter) Filter(response *ffuf.Response) (bool, error) {\n\tmatchheaders := \"\"\n\tfor k, v := range response.Headers {\n\t\tfor _, iv := range v {\n\t\t\tmatchheaders += k + \": \" + iv + \"\\r\\n\"\n\t\t}","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/ffuf/ffuf/blob/33c67d28c85b94589d029b3bcaff205a40cee9c4/pkg/filter/regex.go#L2-L38","documentation":"NewRegexpFilter (pkg/filter/regex.go:20) compiles the user-supplied value as a Go regular expression for the -fr/-mr filter or matcher. If regexp.Compile fails (the pattern is not valid RE2 syntax), the constructor returns this error instead of a RegexpFilter. It exists so invalid CLI input fails fast with the offending value in the message.","triggerScenarios":"Calling NewRegexpFilter(value) or NewFilterByName(\"regexp\", value) / NewFilterByName(\"matcher\", value) with a string that regexp.Compile rejects, e.g. unbalanced '(' or '[', a bad escape like '\\\\q', or an invalid repeat like '*'.","commonSituations":"Typing a PCRE-only construct (lookahead (?=...), backreferences) into -fr on the ffuf command line; shell quoting stripping or mangling backslashes; copying a regex from another language whose syntax Go's RE2 does not support.","solutions":["Fix the regex to be valid Go/RE2 syntax (no lookaheads, backreferences, or possessive quantifiers)","Verify the pattern compiles standalone with a quick `go run` calling regexp.Compile, or `go fmt`-adjacent tools like regex101 with the Golang flavor","Check shell quoting: single-quote the pattern so backslashes and brackets survive","Escape metacharacters properly if you meant to match literal parentheses or brackets"],"exampleFix":"// before\nffuf.FilterProvider, err := NewRegexpFilter(\"foo(?=bar)\") // lookahead: invalid in RE2\n// after\nffuf.FilterProvider, err := NewRegexpFilter(\"foobar\") // or restructure without lookahead","handlingStrategy":"validation","validationCode":"import \"regexp\"\n\nfunc isValidRegexp(value string) bool {\n\t_, err := regexp.Compile(value)\n\treturn err == nil\n}\n// if !isValidRegexp(userValue) { reject before NewRegexpFilter }","typeGuard":null,"tryCatchPattern":"if _, err := NewRegexpFilter(value); err != nil {\n\treturn fmt.Errorf(\"-fr/-mr rejected: %w\", err)\n}","preventionTips":["Validate the pattern with regexp.Compile (Go/RE2) before passing it to ffuf","Avoid PCRE-only features: lookarounds, backreferences, possessive quantifiers","Single-quote regex arguments in shells so backslashes and brackets survive","Test the pattern in a Golang-flavored regex tool before using it in the CLI"],"tags":["regex","input-validation","cli","go"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"33c67d28c85b94589d029b3bcaff205a40cee9c4","analyzedAt":"2026-09-04T18:24:34.068Z","contentChangedAt":"2026-09-04T18:24:34.068Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}