>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3577790. --> Reported by: [breidert](https://www.drupal.org/user/135619) Related to !1294 >>> <p>[Tracker]<br> <strong>Update Summary: </strong>[One-line status update for stakeholders]<br> <strong>Short Description: </strong>[One-line issue summary for stakeholders]<br> <strong>Check-in Date: </strong>MM/DD/YYYY<br> <em>Metadata is used by the <a href="https://www.drupalstarforge.ai/" title="AI Tracker">AI Tracker.</a> Docs and additional fields <a href="https://www.drupalstarforge.ai/ai-dashboard/docs" title="AI Issue Tracker Documentation">here</a>.</em><br> [/Tracker]</p> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>The regexp_guardrail plugin ships with a <a href="https://git.drupalcode.org/project/ai/-/blob/1.3.x/src/Plugin/AiGuardrail/RegexpGuardrail.php?ref_type=heads#L146">validateConfigurationForm()</a> method, but this method is empty and never called when the guardrail configuration form is submitted. As a result, it is possible to save any string as patterms, including syntactically invalid PHP regular expressions. When the guardrail later executes and calls preg_match() with a broken pattern, the guardrail silently passes all inputs instead of blocking them.</p> <p><strong>Steps to reproduce:</strong></p> <ol> <li>Navigate to the guardrail administration page and create or edit a guardrail of type "Regexp Guardrail".</li> <li>Enter an invalid regular expression in the "Regexp Pattern" field, e.g. [unclosed or *invalid.</li> <li>Submit the form.</li> <li>The form saves successfully without any error message.</li> </ol> <p><strong>Expected behavior:</strong></p> <p>The form should reject invalid regular expressions immediately on submission and display a clear error message explaining why the pattern is invalid, e.g.:</p> <blockquote><p>Invalid regular expression: No ending delimiter '/' found</p></blockquote> <p><strong>Root cause:</strong></p> <p>AiGuardrailForm (the EntityForm handler for guardrail entities) does not override validateForm(). The parent EntityForm::validateForm() runs instead and never delegates to the plugin's validateConfigurationForm(). The submit path already correctly calls submitConfigurationForm() via the same delegation pattern.</p> <p>The method validateConfigurationForm() does not contain any validation logic.</p> <h3 id="summary-ai-usage">AI usage (if applicable)</h3> <p>[x] AI Assisted Issue<br> This issue was generated with AI assistance, but was reviewed and refined by the creator.</p> <p>[ ] AI Assisted Code<br> This code was mainly generated by a human, with AI autocompleting or parts AI generated, but under full human supervision.</p> <p>[ ] AI Generated Code<br> This code was mainly generated by an AI with human guidance, and reviewed, tested, and refined by a human.</p> <p>[ ] Vibe Coded<br> This code was generated by an AI and has only been functionally tested.</p> > Related issue: [Issue #3577498](https://www.drupal.org/node/3577498)