{"id":"7cd510f1b287aa4a","repo":"gohugoio/hugo","slug":"failed-to-compile-whitelist-pattern-q-w","errorCode":null,"errorMessage":"failed to compile whitelist pattern %q: %w","messagePattern":"failed to compile whitelist pattern %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/security/whitelist.go","lineNumber":91,"sourceCode":"\t\t\tacceptSome = true\n\t\t\tpatternsStrings = append(patternsStrings, ps)\n\t\t}\n\t}\n\n\tif !acceptSome {\n\t\treturn Whitelist{acceptNone: true}, nil\n\t}\n\n\tvar allow, deny []*regexp.Regexp\n\tfor _, p := range patternsStrings {\n\t\traw := p\n\t\tnegate := strings.HasPrefix(p, hglob.NegationPrefix)\n\t\tif negate {\n\t\t\traw = p[len(hglob.NegationPrefix):]\n\t\t}\n\t\tre, err := regexp.Compile(raw)\n\t\tif err != nil {\n\t\t\treturn Whitelist{}, fmt.Errorf(\"failed to compile whitelist pattern %q: %w\", p, err)\n\t\t}\n\t\tif negate {\n\t\t\tdeny = append(deny, re)\n\t\t} else {\n\t\t\tallow = append(allow, re)\n\t\t}\n\t}\n\n\treturn Whitelist{allow: allow, deny: deny, patternsStrings: patternsStrings}, nil\n}\n\n// MustNewWhitelist creates a new Whitelist from zero or more patterns and panics on error.\nfunc MustNewWhitelist(patterns ...string) Whitelist {\n\tw, err := NewWhitelist(patterns...)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\treturn w","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/gohugoio/hugo/blob/8a468df065a75c1c7cf9f6850f32148746590ea5/config/security/whitelist.go#L73-L109","documentation":"Returned by config/security.NewWhitelist when one of the configured security whitelist patterns fails regexp.Compile. Hugo's security policy (security.exec.allow, security.funcs.getenv, security.http.urls, etc.) is expressed as Go RE2 regular expressions, and any pattern (after stripping the '!' negation prefix) that is not valid RE2 aborts whitelist construction so the security policy is never partially applied.","triggerScenarios":"Setting a value in the [security] section of hugo.toml (e.g. security.exec.allow = ['^dart-sass(']) that is not a valid Go regexp; unbalanced parens/brackets, invalid escapes like \\d in single-quoted YAML contexts gone wrong, or RE2-unsupported syntax such as lookaheads (?=...) or backreferences \\1. Also hits via HUGO_SECURITY_* environment overrides and via MustNewWhitelist in module code, which panics with this wrapped error.","commonSituations":"Developers paste shell glob patterns (dart-sass*) or PCRE with lookahead copied from other tools into security.exec.allow when whitelisting binaries like pandoc, asciidoctor or dart-sass-embedded; forgetting that Hugo expects anchored regexps, not globs; escaping errors introduced when editing TOML vs YAML config formats.","solutions":["Fix the named pattern so it compiles as Go RE2 — test it with regexp.Compile or at regex101 (Golang flavor); RE2 has no lookarounds or backreferences.","If you meant a glob like dart-sass*, write it as a regexp: '^dart-sass' or '^dart-sass.*$'.","Keep the '!' only as a leading negation prefix; the rest of the string after '!' must itself be a valid regexp.","Use the literal 'none' keyword if you want to deny everything instead of writing an empty/broken pattern."],"exampleFix":"# before (hugo.toml)\n[security.exec]\nallow = ['^dart-sass(', 'pandoc(?=.exe)']\n# after\n[security.exec]\nallow = ['^dart-sass', '^pandoc']","handlingStrategy":"validation","validationCode":"// Pre-validate whitelist patterns before building config\nfor _, p := range patterns {\n    if _, err := regexp.Compile(p); err != nil {\n        return fmt.Errorf(\"invalid whitelist pattern %q: %w\", p, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"cfg, err := security.NewWhitelist(patterns...)\nif err != nil {\n    // report the offending pattern verbatim to the user; do not fall back to allow-all\n    return err\n}","preventionTips":["Compile every security.exec/http/funcs whitelist entry with regexp.Compile before shipping the config","Remember Hugo whitelist entries are RE2 regexps, not globs — escape dots and avoid glob syntax like *.example.com","Add a CI step that loads the site config (hugo config) to catch bad patterns early","Prefer the special 'none' keyword over an empty or malformed pattern"],"tags":["hugo","config","security","regexp","go"],"analyzedSha":"8a468df065a75c1c7cf9f6850f32148746590ea5","analyzedAt":"2026-07-31T21:23:07.045Z","schemaVersion":2}