pkg/runner/ports.go (1)

27-36: Harden parsing: prevent 0/negative ports (critical).

Switching to parsePortsSlice for ports-file means inputs like "0", "-1", or "-1-2" will be accepted and even expanded, producing invalid ports. Enforce 1 ≤ port ≤ 65535 for single ports and ranges.

Also wrap underlying errors with %w for better context.

Apply:

-        ports, err := parsePortsSlice(options.PortsFile)
+        ports, err := parsePortsSlice(options.PortsFile)
         if err != nil {
-            return nil, fmt.Errorf("could not read ports: %s", err)
+            return nil, fmt.Errorf("could not read ports: %w", err)
         }
         portsFileMap, err = excludePorts(options, ports)
         if err != nil {
-            return nil, fmt.Errorf("could not read ports: %s", err)
+            return nil, fmt.Errorf("could not read ports: %w", err)
         }

And update parsePortsSlice to validate bounds:

 func parsePortsSlice(ranges []string) ([]*port.Port, error) {
@@
-        if strings.Contains(r, "-") {
+        if strings.Contains(r, "-") {
             parts := strings.Split(r, "-")
             if len(parts) != portListStrParts {
                 return nil, fmt.Errorf("invalid port selection segment: '%s'", r)
             }
 
             p1, err := strconv.Atoi(parts[0])
             if err != nil {
                 return nil, fmt.Errorf("invalid port number: '%s'", parts[0])
             }
 
             p2, err := strconv.Atoi(parts[1])
             if err != nil {
                 return nil, fmt.Errorf("invalid port number: '%s'", parts[1])
             }
 
-            if p1 > p2 || p2 > 65535 {
-                return nil, fmt.Errorf("invalid port range: %d-%d", p1, p2)
-            }
+            if p1 < 1 || p2 < 1 || p1 > p2 || p2 > 65535 {
+                return nil, fmt.Errorf("invalid port range: %d-%d", p1, p2)
+            }
 
             for i := p1; i <= p2; i++ {
                 port := &port.Port{Port: i, Protocol: portProtocol}
                 ports = append(ports, port)
             }
         } else {
             portNumber, err := strconv.Atoi(r)
-            if err != nil || portNumber > 65535 {
+            if err != nil || portNumber < 1 || portNumber > 65535 {
                 return nil, fmt.Errorf("invalid port number: '%s'", r)
             }
             port := &port.Port{Port: portNumber, Protocol: portProtocol}
             ports = append(ports, port)
         }