fix: Prevent ReDoS attack (CWE-1333)

Change regular expression to prevent ReDoS attack: <https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS>
macie · Nov 23, 2022 · f8b77f8 · f8b77f8
1 parent d21a541
commit f8b77f8
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 4 deletions.
diff --git a/dist/smallstache.js b/dist/smallstache.js
@@ -49,7 +49,7 @@
     function fillTemplate(tag, name) {
       return data[name] != null ? data[name] : tag;
     }
-    return this.source.replace(/{{\s*([^}\s]+)\s*}}/g, fillTemplate);
+    return this.source.replace(/{{\s*([^{}\s]+)\s*}}/g, fillTemplate);
   };
 });
 
diff --git a/dist/smallstache.min.js b/dist/smallstache.min.js
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "smallstache",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Lightweight template engine similar to Mustache/Handlebars.",
   "keywords": [
     "smallstache",

diff --git a/src/Smallstache.js b/src/Smallstache.js
@@ -32,7 +32,8 @@ Smallstache.prototype.fill = function(data) {
         return (data[name] != null) ? data[name] : tag;
     }
 
-    return this.source.replace(/{{\s*([^}\s]+)\s*}}/g, fillTemplate);
+    return this.source.replace(/{{\s*([^{}\s]+)\s*}}/g, fillTemplate);
 };
 
 export { Smallstache as default };
+