crowdsecurity/crowdsec · error

cannot compile variable regexp %s: %w

Error message

cannot compile variable regexp %s: %w

What it means

Build() compiles each entry of VariablesTracking as a Go regexp to track specific WAF variables. If regexp.Compile rejects the pattern (invalid syntax), the build aborts with this error wrapping the regexp error. It is a config-authoring bug in the appsec-config YAML.

Source

Thrown at pkg/appsec/appsec.go:1051

	// on_challenge_submit hooks: same merge pattern; in-band only.
	onChallengeSubmitHooks := wc.OnChallengeSubmit
	if wc.InBand != nil {
		onChallengeSubmitHooks = append(onChallengeSubmitHooks, wc.InBand.OnChallengeSubmit...)
	}

	if ret.CompiledOnChallengeSubmit, err = buildHookList(ctx, onChallengeSubmitHooks, hookOnChallengeSubmit, patcher); err != nil {
		return nil, err
	}

	if len(ret.CompiledOnChallengeSubmit) > 0 {
		patcher.NeedWASMVM = true
	}

	// variable tracking
	for _, variable := range wc.VariablesTracking {
		compiledVariableRule, err := regexp.Compile(variable)
		if err != nil {
			return nil, fmt.Errorf("cannot compile variable regexp %s: %w", variable, err)
		}

		ret.CompiledVariablesTracking = append(ret.CompiledVariablesTracking, compiledVariableRule)
	}

	ret.NeedWASMVM = patcher.NeedWASMVM

	return ret, nil
}

// processHooks runs a list of compiled hooks with the given environment.
//
// state, when non-nil, is consulted between rule iterations: if
// state.HooksHalted is true (set by a terminal expr helper such as
// RejectSubmission or the on_challenge_submit GrantChallengeCookie),
// remaining rules in this phase are skipped. ProcessOnLoadRules passes
// nil — it has no request state at all.
func (w *AppsecRuntimeConfig) processHooks(hooks []Hook, env map[string]interface{}, hookType string, state *AppsecRequestState) error {

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the regex syntax in variables_tracking; test it with a RE2-compatible checker (regex101 with Golang flavor)
2. Remove unsupported PCRE constructs (lookaheads/lookbehinds, backreferences) — Go regexp does not support them
3. Quote the YAML value properly so backslashes survive: use single quotes
4. Read the wrapped error position (`error parsing regexp: ...`) to locate the offending character

Example fix

// before
variables_tracking:
  - "(?<=foo)bar"
// after
variables_tracking:
  - 'foobar'

for _, v := range cfg.VariablesTracking {
    if _, err := regexp.Compile(v); err != nil {
        return fmt.Errorf("invalid variables_tracking regex %q: %w", v, err)
    }
}

if err := buildAppsecRuntime(cfg); err != nil {
    var reErr error
    if strings.Contains(err.Error(), "cannot compile variable regexp") {
        log.Fatalf("fix variables_tracking regex: %v", err)
    }
    return err
}

When it happens

Trigger: An entry under variables_tracking: contains invalid regex syntax, e.g. unbalanced parentheses, a trailing `+`, or an invalid escape like `\d` without proper quoting issues (Go RE2 rejects some PCRE constructs).

Common situations: Custom appsec-config with hand-written regex; copying a PCRE regex using lookaheads (`(?=...)`) which Go's RE2 does not support; accidental YAML unquoting mangling backslashes.

Related errors

• ref cannot be empty
• on_challenge hooks are only valid in-band, not under outofba
• on_challenge_submit hooks are only valid in-band, not under
• max_body_size must be a positive integer
• empty master secret

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b04ab1feda48087e. Report an issue: GitHub.