Can't use regex in module attributes using Elixir v1.18

[jaeyson]

Hi! was compiling phx_2_ban when this happened:

== Compilation error in file lib/phx_2_ban/rules/python.ex ==
** (ArgumentError) cannot inject attribute @regex_patterns into function/macro because cannot escape #Reference<0.3849436586.1497235463.120178>. The supported values are: lists, tuples, maps, atoms, numbers, bitstrings, PIDs and remote functions in the format &Mod.fun/arity
    (elixir 1.18.4) lib/kernel.ex:3777: Kernel.do_at_escape/2
    (elixir 1.18.4) expanding macro: Kernel.@/1
    lib/phx_2_ban/rules/python.ex:30: Phx2Ban.Rules.Python.valid_request?/1

I have no idea how to fix this, but the current setup is:

• Elixir 1.18 (asdf)
• Erlang 27.3 (asdf)
• osx 15.3

My workaround here is to downgrade from v1.18 to v1.17. Not also sure if this is actually an issue tbh.

[Hermanverschooten]

Hi, I get the same error, but only on Erlang 28. Compiles fine on 1.18.4 with 27.3.4.

==> phx_2_ban
Compiling 17 files (.ex)

== Compilation error in file lib/phx_2_ban/rules/php.ex ==
** (ArgumentError) cannot inject attribute @regex_patterns into function/macro because cannot escape #Reference<0.2903263813.3671982089.110287>. The supported values are: lists, tuples, maps, atoms, numbers, bitstrings, PIDs and remote functions in the format &Mod.fun/arity
    (elixir 1.18.4) lib/kernel.ex:3777: Kernel.do_at_escape/2
    (elixir 1.18.4) expanding macro: Kernel.@/1
    (phx_2_ban 0.2.3) lib/phx_2_ban/rules/php.ex:28: Phx2Ban.Rules.PHP.valid_request?/1
could not compile dependency :phx_2_ban, "mix compile" failed. Errors may have been logged above. You can recompile this dependency with "mix deps.compile phx_2_ban --force", update it with "mix deps.update phx_2_ban" or clean it with "mix deps.clean phx_2_ban"
MiniM4➜  faulty_tower git:(main) ✗ mix deps.compile phx_2_ban --force
==> phx_2_ban
Compiling 17 files (.ex)

== Compilation error in file lib/phx_2_ban/rules/linux.ex ==
** (ArgumentError) cannot inject attribute @regex_patterns into function/macro because cannot escape #Reference<0.3827484686.450232330.34480>. The supported values are: lists, tuples, maps, atoms, numbers, bitstrings, PIDs and remote functions in the format &Mod.fun/arity
    (elixir 1.18.4) lib/kernel.ex:3777: Kernel.do_at_escape/2
    (elixir 1.18.4) expanding macro: Kernel.@/1
    lib/phx_2_ban/rules/linux.ex:28: Phx2Ban.Rules.Linux.valid_request?/1
could not compile dependency :phx_2_ban, "mix compile" failed. Errors may have been logged above. You can recompile this dependency with "mix deps.compile phx_2_ban --force", update it with "mix deps.update phx_2_ban" or clean it with "mix deps.clean phx_2_ban"

[Hermanverschooten]

The solution seems to be to move the regex into a function.

defmodule Phx2Ban.Rules.PHP do
  @moduledoc """
  This module provides rules to check for common PHP
  files that attacked may be fuzzing for.
  """
  use Phx2Ban.Rule
  
  @impl true
  def label do
    :php
  end
  
  @impl true
  def description do
    "This rule checks for common PHP extensions like *.php and routes."
  end
  
  @impl true
  def valid_request?(%ConnData{req_route_exists?: true}), do: true
  def valid_request?(%ConnData{request_path: request_path}) do
    not Enum.any?(regex_patterns(), fn regex ->
      Regex.match?(regex, request_path)
    end)
  end
  
  defp regex_patterns do
    [
      ~r/\.(?:php|php3|php4|php5|phtml)$/,
      ~r/(?:phpinfo|phpunit|phpsso_server|php-info|php-ofc-library|phpmyadmin|zb_system)/
    ]
  end
end

[jaeyson]

@Hermanverschooten oh I didn't know that. TIL passing regex in module attributes is making error 👀

@PJUllrich would sending patch files work for PR cases?

[jaeyson]

There's a similar issue open-api-spex/open_api_spex#670 (comment)

This change isn't actually necessary anymore. OTP 28.1 will restore this functionality, and Elixir 1.19 will be delayed until that happens.

In OTP, they discussed Regular expression export/import erlang/otp#9976 (comment)

The plan is to get this export/import functionality into 28.1. And then potentially do the loader optimization later maybe already in 28.2.

[akoutmos]

Hello everyone!

Apologizes for the delayed response. I'm in the middle of a move and just saw this. We are aware of the OTP 28 (https://github.com/elixir-lang/elixir/blob/v1.18/CHANGELOG.md#v1184-2025-05-21) change and will update Phx2Ban in the coming days.

Appreciate your patience,
Alex

[jaeyson]

No worries Alex!

[PJUllrich]

Hey folks, I wasn't able to replicate it with OTP 28 because some of the dependencies (e.g. credo) also broke and I couldn't compile the phx_2_ban project but I've just released a new Phx2Ban version 0.2.4 in which I move the regexes to private functions. That should fix this issue with OTP 28, so please let me know if that fixed it for you :)