Fix edge cases in rule parser and test

- Fix test mock targeting console.warn instead of console.log in
  buildLegacyRules empty portsInput test
- Guard against whitespace-only portsInput by trimming before fallback
- Validate regex syntax in ~-prefixed rules to fail early instead of
  crashing HAProxy at startup

Author: dash14

setup/lib/rules.mjs

@@ -13,7 +13,11 @@ export function buildRules(rulesInput) {
  */
 export function convertRule(rule) {
   if (rule.startsWith('~')) {
-    return rule.slice(1);
+    const regex = rule.slice(1);
+    try { new RegExp(regex); } catch (e) {
+      throw new Error(`Invalid regex in rule "${rule}": ${e.message}`);
+    }
+    return regex;
   }
   return `^${wildcardToRegex(rule)}$`;
 }
@@ -67,7 +71,7 @@ export function buildLegacyRules({ domainsInput, portsInput, defaultPort, protoc
     `::warning::Deprecated: allowed_${protocol.toLowerCase()}_domains / ${protocol.toLowerCase()}_ports inputs are deprecated. ` +
     `Use allowed_${protocol.toLowerCase()}_rules instead.`
   );
-  return convertLegacyDomains(domainsInput, portsInput || String(defaultPort));
+  return convertLegacyDomains(domainsInput, portsInput?.trim() || String(defaultPort));
 }
 
 /**

setup/lib/rules.test.mjs

@@ -92,6 +92,10 @@ describe("convertRule", () => {
       "^custom\\.regex:443$",
     );
   });
+
+  it("rejects invalid regex (~ prefix)", () => {
+    assert.throws(() => convertRule("~^(unclosed"), /Invalid regex/);
+  });
 });
 
 // ---------------------------------------------------------------------------
@@ -228,8 +232,8 @@ describe("buildLegacyRules", () => {
   });
 
   it("falls back to defaultPort when portsInput is empty", () => {
-    const origWarn = console.warn;
-    console.warn = () => {};
+    const origLog = console.log;
+    console.log = () => {};
     try {
       const result = buildLegacyRules({
         domainsInput: "example.com",
@@ -239,7 +243,7 @@ describe("buildLegacyRules", () => {
       });
       assert.deepEqual(result, ["^example\\.com:443$"]);
     } finally {
-      console.warn = origWarn;
+      console.log = origLog;
     }
   });
 });