From 00f941b2ac535522e63681d4e73a8833009246f1 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Tue, 29 Sep 2026 10:31:40 -0400 Subject: [PATCH] Guard against negative capture group in regexp string transform Signed-off-by: Arpit Jain --- transforms.go | 2 +- transforms_test.go | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/transforms.go b/transforms.go index 0e7c8ea..0e63200 100644 --- a/transforms.go +++ b/transforms.go @@ -392,7 +392,7 @@ func stringRegexpTransform(input any, r v1beta1.StringTransformRegexp) (string, // Return the entire match (group zero) by default. g := ptr.Deref[int](r.Group, 0) - if len(groups) == 0 || g >= len(groups) { + if len(groups) == 0 || g < 0 || g >= len(groups) { return "", errors.Errorf(errStringTransformTypeRegexpNoMatch, r.Match, g) } diff --git a/transforms_test.go b/transforms_test.go index 03c9890..c1e3290 100644 --- a/transforms_test.go +++ b/transforms_test.go @@ -976,6 +976,19 @@ func TestStringResolve(t *testing.T) { err: errors.Errorf(errStringTransformTypeRegexpNoMatch, "my-([0-9]+)-string", 2), }, }, + "RegexpNegativeCaptureGroup": { + args: args{ + stype: v1beta1.StringTransformTypeRegexp, + regexp: &v1beta1.StringTransformRegexp{ + Match: "my-([0-9]+)-string", + Group: new(-1), + }, + i: "my-1-string", + }, + want: want{ + err: errors.Errorf(errStringTransformTypeRegexpNoMatch, "my-([0-9]+)-string", -1), + }, + }, "ConvertToJSONSuccess": { args: args{ stype: v1beta1.StringTransformTypeConvert,