{"record":{"id":"daba86be8eae6556","repo":"crowdsecurity/crowdsec","slug":"unknown-ip-size-d-w","errorCode":null,"errorMessage":"unknown ip size %d: %w","messagePattern":"unknown ip size (.+?): %w","errorType":"exception","errorClass":"InvalidFilter","httpStatus":null,"severity":"error","filePath":"pkg/database/alertfilter.go","lineNumber":150,"sourceCode":"\t\t\t\t\talert.HasDecisionsWith(decision.EndSuffixLTE(rng.End.Sfx)),\n\t\t\t\t),\n\t\t\t),\n\t\t))\n\t}\n}\n\nfunc handleAlertIPPredicates(rng csnet.Range, contains bool, predicates *[]predicate.Alert) error {\n\tswitch rng.Size() {\n\tcase 4:\n\t\thandleAlertIPv4Predicates(rng, contains, predicates)\n\t\treturn nil\n\tcase 16:\n\t\thandleAlertIPv6Predicates(rng, contains, predicates)\n\t\treturn nil\n\tcase 0:\n\t\treturn nil\n\tdefault:\n\t\treturn fmt.Errorf(\"unknown ip size %d: %w\", rng.Size(), InvalidFilter)\n\t}\n}\n\nfunc handleIncludeCapiFilter(value string, predicates *[]predicate.Alert) error {\n\tif value == \"false\" {\n\t\t*predicates = append(*predicates, alert.And(\n\t\t\t// do not show alerts with active decisions having origin CAPI or lists\n\t\t\talert.And(\n\t\t\t\talert.Not(alert.HasDecisionsWith(decision.OriginEQ(types.CAPIOrigin))),\n\t\t\t\talert.Not(alert.HasDecisionsWith(decision.OriginEQ(types.ListOrigin))),\n\t\t\t),\n\t\t\talert.Not(\n\t\t\t\talert.And(\n\t\t\t\t\t// do not show neither alerts with no decisions if the Source Scope is lists: or CAPI\n\t\t\t\t\talert.Not(alert.HasDecisions()),\n\t\t\t\t\talert.Or(\n\t\t\t\t\t\talert.SourceScopeHasPrefix(types.ListOrigin+\":\"),\n\t\t\t\t\t\talert.SourceScopeEQ(types.CommunityBlocklistPullSourceScope),","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/alertfilter.go#L132-L168","documentation":"Returned by handleAlertIPPredicates when the parsed IP range's address size is neither 4 nor 16 bytes nor 0, meaning the netip.Prefix/range holds an address family the filter code does not handle. Wraps the size and the InvalidFilter sentinel.","triggerScenarios":"A 'range' or 'contains' style alert filter provides an IP value that parses to an unexpected address size — practically only with malformed/ambiguous input that produced a non-standard range.","commonSituations":"Scripts passing garbage IP strings into LAPI /v1/alerts range filters, proxy headers injecting malformed X-Forwarded-For-derived values, or custom integrations building filters programmatically.","solutions":["Send a valid IPv4 or IPv6 address/CIDR in the filter (e.g. 1.2.3.4 or 2001:db8::/32).","Validate the IP client-side with net.ParseIP / netip.ParsePrefix before querying.","If behind a proxy, ensure forwarded headers are sanitized to real IPs.","Check the client is not passing an empty-but-nonzero byte slice for the IP."],"exampleFix":"// before\ncurl '.../alerts?range=999.1.1.1'\n// after\ncurl '.../alerts?range=1.2.3.4'","handlingStrategy":"validation","validationCode":"prefix, err := netip.ParsePrefix(value)\nif err != nil || (prefix.Addr().BitLen() != 32 && prefix.Addr().BitLen() != 128) {\n    return fmt.Errorf(\"range %q is not a valid IPv4/IPv6 prefix\", value)\n}","typeGuard":null,"tryCatchPattern":"if err := handleAlertIPPredicates(rng, contains, &preds); err != nil {\n    if errors.Is(err, InvalidFilter) {\n        return http.StatusBadRequest\n    }\n    return err\n}","preventionTips":["Validate IPs with net.ParseIP before putting them in query strings","Sanitize X-Forwarded-For values before deriving filters","Only send AF_INET/AF_INET6 addresses to LAPI"],"tags":["go","ip","lapi"],"backgroundTag":"invalid-argument-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}