Merge pull request #2328 from cbxcvl/fix/parse-if-redos

fix(renderer): remove ambiguous \s* from _parse_if regex to prevent ReDoS
This commit is contained in:
Lysec
2026-03-31 02:52:27 +02:00
committed by GitHub
+1 -1
View File
@@ -359,7 +359,7 @@ class TemplateRenderer:
condition_part = condition_part[4:].strip()
# Extract expression from {{ ... }} if present
expr_match = re.match(r'\{\{\s*(.+?)\s*\}\}', condition_part)
expr_match = re.match(r'\{\{(.+?)\}\}', condition_part)
if expr_match:
condition_expr = expr_match.group(1).strip()
else: