{"record":{"id":"eedaa9cdf068c4f0","repo":"crowdsecurity/crowdsec","slug":"invalid-grantchallengecookie-ttl-q-w","errorCode":null,"errorMessage":"invalid GrantChallengeCookie TTL %q: %w","messagePattern":"invalid GrantChallengeCookie TTL %q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/waf_helpers.go","lineNumber":62,"sourceCode":"// parseChallengeCookieTTLArg interprets the optional TTL argument to the\n// GrantChallengeCookie expr helper. Zero variadic args means \"use the\n// runtime default\" and yields a nil override. A single non-empty string is\n// parsed with time.ParseDuration (e.g. \"1h\", \"30m\"). More than one TTL\n// argument or an unparseable value is reported as an error so hook authors\n// get a precise diagnostic at evaluation time rather than a silent fallback.\nfunc parseChallengeCookieTTLArg(ttl []string) (*time.Duration, error) {\n\tif len(ttl) == 0 {\n\t\treturn nil, nil\n\t}\n\tif len(ttl) > 1 {\n\t\treturn nil, fmt.Errorf(\"GrantChallengeCookie accepts at most one TTL argument, got %d\", len(ttl))\n\t}\n\tif ttl[0] == \"\" {\n\t\treturn nil, nil\n\t}\n\td, err := time.ParseDuration(ttl[0])\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid GrantChallengeCookie TTL %q: %w\", ttl[0], err)\n\t}\n\tif d <= 0 {\n\t\treturn nil, fmt.Errorf(\"GrantChallengeCookie TTL must be positive, got %s\", d)\n\t}\n\treturn &d, nil\n}\n\nfunc GetOnLoadEnv(w *AppsecRuntimeConfig) map[string]interface{} {\n\treturn map[string]interface{}{\n\t\t\"RemoveInBandRuleByID\":         w.DisableInBandRuleByID,\n\t\t\"RemoveInBandRuleByTag\":        w.DisableInBandRuleByTag,\n\t\t\"RemoveInBandRuleByName\":       w.DisableInBandRuleByName,\n\t\t\"RemoveOutBandRuleByID\":        w.DisableOutBandRuleByID,\n\t\t\"RemoveOutBandRuleByTag\":       w.DisableOutBandRuleByTag,\n\t\t\"RemoveOutBandRuleByName\":      w.DisableOutBandRuleByName,\n\t\t\"SetRemediationByTag\":          w.SetActionByTag,\n\t\t\"SetRemediationByID\":           w.SetActionByID,\n\t\t\"SetRemediationByName\":         w.SetActionByName,","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/waf_helpers.go#L44-L80","documentation":"The single TTL argument passed to GrantChallengeCookie could not be parsed by time.ParseDuration — e.g. \"1 hour\", \"1d\", or a typo. The invalid literal is echoed along with the parse error; the helper errors instead of silently falling back to the runtime default.","triggerScenarios":"Thrown at pkg/appsec/waf_helpers.go:62 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use Go duration syntax: \"1h\", \"30m\", \"90s\" — \"d\" (days) is not supported, express it in hours"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}