// line 131
matched = forbiddenLabels.RegexMatch(label)
// line 150
matched = forbiddenAnnotations.RegexMatch(annotation)

func (in ForbiddenListSpec) RegexMatch(value string) (ok bool) {
    if len(in.Regex) > 0 {
        ok = regexp.MustCompile(in.Regex).MatchString(value) // ← panics on invalid regex
    }
    return ok
}

package main

import (
    "fmt"
    "regexp"
)

type ForbiddenListSpec struct{ Regex string }

// Exact copy of pkg/api/forbidden_list.go:34-38
func (in ForbiddenListSpec) RegexMatch(value string) bool {
    if len(in.Regex) > 0 {
        return regexp.MustCompile(in.Regex).MatchString(value)
    }
    return false
}

func main() {
    // 1. cfg webhook has no validator → invalid regex stored in etcd
    // (no webhook in internal/webhook/cfg/ checks regex fields)

    // 2. Stored malformed regex loaded from CapsuleConfiguration
    forbidden := ForbiddenListSpec{Regex: `[invalid-regex(`}

    // 3. node/user_metadata.go:131 called on every Node admission request
    defer func() {
        if r := recover(); r != nil {
            fmt.Printf("PANIC: %v\n", r)
            // Output: PANIC: regexp: Compile(`[invalid-regex(`): error parsing regexp: missing closing ]
        }
    }()
    forbidden.RegexMatch("kubernetes.io/hostname")
}

package cfg

import (
    "context"
    "regexp"

    "sigs.k8s.io/controller-runtime/pkg/client"
    "sigs.k8s.io/controller-runtime/pkg/webhook/admission"

    capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
    ad "github.com/projectcapsule/capsule/pkg/runtime/admission"
    "github.com/projectcapsule/capsule/pkg/runtime/events"
    "github.com/projectcapsule/capsule/pkg/runtime/handlers"
)

type nodeMetadataRegexHandler struct{}

func NodeMetadataRegexHandler() handlers.TypedHandler[*capsulev1beta2.CapsuleConfiguration] {
    return &nodeMetadataRegexHandler{}
}

func (h *nodeMetadataRegexHandler) OnCreate(
    _ client.Client,
    _ client.Reader,
    cfg *capsulev1beta2.CapsuleConfiguration,
    _ admission.Decoder,
    _ events.EventRecorder,
) handlers.Func {
    return func(_ context.Context, req admission.Request) *admission.Response {
        return h.validate(cfg, req)
    }
}

func (h *nodeMetadataRegexHandler) OnDelete(
    client.Client,
    client.Reader,
    *capsulev1beta2.CapsuleConfiguration,
    admission.Decoder,
    events.EventRecorder,
) handlers.Func {
    return func(context.Context, admission.Request) *admission.Response {
        return nil
    }
}

func (h *nodeMetadataRegexHandler) OnUpdate(
    _ client.Client,
    _ client.Reader,
    cfg *capsulev1beta2.CapsuleConfiguration,
    _ *capsulev1beta2.CapsuleConfiguration,
    _ admission.Decoder,
    _ events.EventRecorder,
) handlers.Func {
    return func(_ context.Context, req admission.Request) *admission.Response {
        return h.validate(cfg, req)
    }
}

func (h *nodeMetadataRegexHandler) validate(cfg *capsulev1beta2.CapsuleConfiguration, req admission.Request) *admission.Response {
    if cfg.Spec.NodeMetadata == nil {
        return nil
    }

    expressions := map[string]string{
        "labels":      cfg.Spec.NodeMetadata.ForbiddenLabels.Regex,
        "annotations": cfg.Spec.NodeMetadata.ForbiddenAnnotations.Regex,
    }

    for scope, expression := range expressions {
        if expression == "" {
            continue
        }

        if _, err := regexp.Compile(expression); err != nil {
            return ad.Denyf(
                "unable to compile regex %q for forbidden %s: %v",
                expression,
                scope,
                err,
            )
        }
    }

    return nil
}