{"record":{"id":"ed017c66fb18ffb0","repo":"zeroclaw-labs/zeroclaw","slug":"static-slack-workflow-token-regex-must-compile","errorCode":null,"errorMessage":"static Slack workflow token regex must compile","messagePattern":"static Slack workflow token regex must compile","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/zeroclaw-runtime/src/security/leak_detector.rs","lineNumber":212,"sourceCode":"                ),\n                (\n                    Regex::new(r\"github_pat_[a-zA-Z0-9_]{22,}\").unwrap(),\n                    \"GitHub PAT\",\n                ),\n                // Slack\n                (\n                    Regex::new(r\"xox[baprs]-[0-9A-Za-z-]{10,}\")\n                        .expect(\"static Slack token regex must compile\"),\n                    \"Slack token\",\n                ),\n                (\n                    Regex::new(r\"xapp-[0-9A-Za-z-]{10,}\")\n                        .expect(\"static Slack app-level token regex must compile\"),\n                    \"Slack app-level token\",\n                ),\n                (\n                    Regex::new(r\"xwfp-[0-9A-Za-z-]{10,}\")\n                        .expect(\"static Slack workflow token regex must compile\"),\n                    \"Slack workflow token\",\n                ),\n                (\n                    // Rotation family: refresh tokens (`xoxe-…`) and rotated\n                    // access tokens (`xoxe.xoxb-…`, `xoxe.xoxp-…`). The base\n                    // `xox[baprs]-` class excludes `e`, and matching only the\n                    // inner `xoxb-`/`xoxp-` would leave the `xoxe.` prefix\n                    // unredacted, so cover the whole token explicitly.\n                    Regex::new(r\"xoxe(?:-[0-9A-Za-z-]{10,}|\\.xox[bp]-[0-9A-Za-z-]{10,})\")\n                        .expect(\"static Slack rotation token regex must compile\"),\n                    \"Slack refresh/rotated token\",\n                ),\n                // Generic\n                (\n                    Regex::new(r#\"api[_-]?key[=:]\\s*['\"]*[a-zA-Z0-9_-]{20,}\"#).unwrap(),\n                    \"Generic API key\",\n                ),\n            ]","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-runtime/src/security/leak_detector.rs#L194-L230","documentation":"Panic guard inside the secret-leak scanner's API-key pattern table. check_api_keys compiles a hard-coded regex for Slack workflow tokens (xwfp-...) and .expect() fires only if that literal fails to compile. In a shipped build the pattern is a constant, so this panic is unreachable unless someone edited the regex source into an invalid pattern.","triggerScenarios":"A contributor edits the `xwfp-[0-9A-Za-z-]{10,}` literal into an invalid regex (unbalanced bracket, bad escape, stray brace) and any code path then runs a leak scan: scan_with_protected_spans -> check_api_keys builds the pattern table and panics at Regex construction time.","commonSituations":"Adding or tweaking Slack token families in the leak detector; rebasing a branch where the pattern changed; running the security test suite after hand-editing detector patterns.","solutions":["Fix the regex literal back to a valid pattern such as `xwfp-[0-9A-Za-z-]{10,}` and re-run `cargo test -p zeroclaw-runtime` for the security/leak-detector tests","Paste the edited pattern into a scratch `regex::Regex::new(...)` test to get the exact syntax error before committing","Keep character-class edits minimal and covered by the existing leak-detector unit tests"],"exampleFix":"// before\nRegex::new(r\"xwfp-[0-9A-Za-z-{10,}\") // unbalanced character class\n    .expect(\"static Slack workflow token regex must compile\"),\n\n// after\nRegex::new(r\"xwfp-[0-9A-Za-z-]{10,}\")\n    .expect(\"static Slack workflow token regex must compile\"),","handlingStrategy":"validation","validationCode":"#[test]\nfn leak_detector_patterns_compile() {\n    let patterns = [\n        r\"xwfp-[0-9A-Za-z-]{10,}\",\n        r\"xoxe(?:-[0-9A-Za-z-]{10,}|\\.xox[bp]-[0-9A-Za-z-]{10,})\",\n    ];\n    for p in patterns {\n        regex::Regex::new(p).expect(\"static pattern must compile\");\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never edit hard-coded detector patterns without running the security test suite afterwards","Add a unit test that compiles every pattern in the table so a broken literal fails in CI, not during a production scan"],"tags":["rust","regex","panic","leak-detector","slack"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}