What causes "malformed change data matcher: %s" in slimtoolkit/slim?

Use the full 4-field form: dump: : : , e.g. dump:/tmp/out::'(?i)password'.

malformed change data matcher: %s

Error message

malformed change data matcher: %s

What it means

parseChangeDataMatchers in the xray command (pkg/app/master/command/xray/cli.go:432) parses --change-data matcher values. A value starting with 'dump:' must have the 4-part form 'dump:output:path_pattern:data_regex' (SplitN on ':' into exactly 4 parts); anything with fewer separators, e.g. 'dump:console' or 'dump:dir:regex', fails and returns "malformed change data matcher: %s".

Source

Thrown at pkg/app/master/command/xray/cli.go:432

			outputs["report"] = struct{}{}
		case "console":
			outputs["console"] = struct{}{}
		}
	}

	return outputs, nil
}

func parseChangeDataMatchers(values []string) ([]*dockerimage.ChangeDataMatcher, error) {
	var matchers []*dockerimage.ChangeDataMatcher

	for _, raw := range values {
		var m dockerimage.ChangeDataMatcher

		if strings.HasPrefix(raw, "dump:") {
			parts := strings.SplitN(raw, ":", 4)
			if len(parts) != 4 {
				return nil, fmt.Errorf("malformed change data matcher: %s", raw)
			}

			m.Dump = true

			outTarget := strings.TrimSpace(parts[1])
			if len(outTarget) == 0 || outTarget == dockerimage.CDMDumpToConsole {
				m.DumpConsole = true
			} else {
				m.DumpDir = outTarget
			}

			m.PathPattern = parts[2]
			m.DataPattern = parts[3]

			//"dump:output:path_ptrn:data_regex"
			//"::path_ptrn:data_regex"
			//":::data_regex"
			//"data_regex"

View on GitHub (pinned to 81940d17fa)

Solutions

Use the full 4-field form: dump:<output-dir-or-empty>:<path-pattern>:<data-regex>, e.g. dump:/tmp/out::'(?i)password'.
If the path pattern is empty, keep the separator: dump:out::regex or :::regex.
If you only want a data regex with no dump, drop the 'dump:' prefix entirely (e.g. just '(?i)secret').
Count the colons: a dump-prefixed data matcher needs exactly 3 colons (4 fields).

Example fix

// before
--change-data 'dump:/tmp/dump:PASSWORD.*'
// after
--change-data 'dump:/tmp/dump::PASSWORD.*'

Defensive patterns

Strategy: validation

Validate before calling

// validate a dump-form change-data matcher before passing it to the CLI
func validDataMatcher(raw string) bool {
    if !strings.HasPrefix(raw, "dump:") {
        return true // plain regex form
    }
    return len(strings.SplitN(raw, ":", 4)) == 4
}

Try / catch

matchers, err := parseChangeDataMatchers(values)
if err != nil {
    if strings.HasPrefix(err.Error(), "malformed change data matcher") {
        fmt.Fprintf(os.Stderr, "expected dump:out:path_pattern:data_regex (3 colons) or plain regex: %v\n", err)
        os.Exit(2)
    }
    return err
}

Prevention

Quote matcher values in shell so empty fields survive: 'dump:out::regex'.
Remember the field counts: data matcher dump form = 4 fields (3 colons).
Test complex matchers against strings.SplitN(value, ":", 4) before deploying.
Prefer plain-regex form when the path pattern is not needed.

When it happens

Trigger: Passing a --change-data value beginning with 'dump:' that does not contain three ':' separators producing exactly 4 fields — e.g. 'dump:console', 'dump:/tmp/out', 'dump:/tmp/out:.*' (only 3 parts).

Common situations: Users forget the path-pattern field even when it should be empty, writing 'dump:out:regex' instead of 'dump:out::regex'; quoting issues in shell cause ':' groups to be lost; copy-pasting examples that dropped one of the empty middle fields.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/9e3e34ab313c6ba9. Report an issue: GitHub.