mozilla / nunjucks

A powerful templating engine with inheritance, asynchronous control, and more (jinja2 inspired)
https://mozilla.github.io/nunjucks/
BSD 2-Clause "Simplified" License
8.48k stars 635 forks source link

[Security] Fix ReDoS #1370

Open ready-research opened 2 years ago

ready-research commented 2 years ago

Summary

Proposed change: Fix ReDoS

Reported in https://www.huntr.dev/bounties/cbba8293-0ca2-474c-970c-91536241b6fa/ you can access this using GitHub. Please validate using Mark as valid and also confirm the fix. Thank you.

Checklist

I've completed the checklist below to ensure I didn't forget anything. This makes reviewing this PR as easy as possible for the maintainers. And it gets this change released as soon as possible.

ogonkov commented 2 years ago

Please add test

hadasbloom commented 2 years ago

Hey, any update on this issue?

ogonkov commented 2 years ago

This code definitely break some tests