From 2a177b9e996ff8d806f034fb19c3a6c563a57098 Mon Sep 17 00:00:00 2001
From: TBX3D <88289044+TBX3D@users.noreply.github.com>
Date: Wed, 8 Jul 2026 13:30:12 -0700
Subject: [PATCH] fix(modules): guard regex extractor against negative group
 index

a module with a negative extractor group indexed matches[e.Group] past
the lower bound, panicking the executor goroutine and crashing the whole
scan. the existing bound only checked the upper end; check e.Group >= 0
too so an invalid group is skipped like an out-of-range one.
---
 internal/modules/executor.go      | 2 +-
 internal/modules/matchers_test.go | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/internal/modules/executor.go b/internal/modules/executor.go
index f969581a..0dcc9e90 100644
--- a/internal/modules/executor.go
+++ b/internal/modules/executor.go
@@ -487,7 +487,7 @@ func runExtractors(extractors []Extractor, resp *http.Response, body string) map
 					continue
 				}
 				matches := re.FindStringSubmatch(part)
-				if len(matches) > e.Group {
+				if e.Group >= 0 && len(matches) > e.Group {
 					result[e.Name] = matches[e.Group]
 					break
 				}
diff --git a/internal/modules/matchers_test.go b/internal/modules/matchers_test.go
index 30834f11..eff21893 100644
--- a/internal/modules/matchers_test.go
+++ b/internal/modules/matchers_test.go
@@ -333,6 +333,14 @@ func TestRunExtractors(t *testing.T) {
 			},
 			wantNil: true,
 		},
+		{
+			// a negative group must be skipped, not panic on matches[-1].
+			name: "negative group is skipped",
+			extractors: []Extractor{
+				{Type: "regex", Name: "session", Part: "body", Regex: []string{`"session":"([^"]+)"`}, Group: -1},
+			},
+			wantNil: true,
+		},
 		{
 			name: "invalid pattern is skipped, no capture",
 			extractors: []Extractor{