From f130c8b4d88f01af6e8670d5a1ecb12f9ab91121 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Fri, 24 Jul 2026 01:42:27 +0900 Subject: [PATCH] Guard against negative capture group in regexp string transform The regexp string transform checks that the requested capture group index is within the upper bound of the matched groups, but not that it is non-negative. A negative group value in the Composition (Group is *int) slips past len(groups) == 0 || g >= len(groups) and then panics on groups[g] with an index out of range. Add the lower-bound check so a negative group returns the existing no-match error instead of panicking. Includes a test covering a negative group value. Signed-off-by: Arpit Jain --- transforms.go | 2 +- transforms_test.go | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/transforms.go b/transforms.go index d22a894..6238181 100644 --- a/transforms.go +++ b/transforms.go @@ -392,7 +392,7 @@ func stringRegexpTransform(input any, r v1beta1.StringTransformRegexp) (string, // Return the entire match (group zero) by default. g := ptr.Deref[int](r.Group, 0) - if len(groups) == 0 || g >= len(groups) { + if len(groups) == 0 || g < 0 || g >= len(groups) { return "", errors.Errorf(errStringTransformTypeRegexpNoMatch, r.Match, g) } diff --git a/transforms_test.go b/transforms_test.go index 8414afd..f322cfc 100644 --- a/transforms_test.go +++ b/transforms_test.go @@ -977,6 +977,19 @@ func TestStringResolve(t *testing.T) { err: errors.Errorf(errStringTransformTypeRegexpNoMatch, "my-([0-9]+)-string", 2), }, }, + "RegexpNegativeCaptureGroup": { + args: args{ + stype: v1beta1.StringTransformTypeRegexp, + regexp: &v1beta1.StringTransformRegexp{ + Match: "my-([0-9]+)-string", + Group: ptr.To[int](-1), + }, + i: "my-1-string", + }, + want: want{ + err: errors.Errorf(errStringTransformTypeRegexpNoMatch, "my-([0-9]+)-string", -1), + }, + }, "ConvertToJSONSuccess": { args: args{ stype: v1beta1.StringTransformTypeConvert,