Files
f20c82fb15 Fix Jinja2 false-positive when URL contains {% (#4208)
* Add tests for Jinja2 template detection in URL validation (RED)

* Fix Jinja2 false-positive when URL contains `{%` (GREEN)

* Consolidate Jinja2 template detection across URL/body/headers validation

* Propagate `FORCE_COLOR` to test containers

* Apply suggestion from @dgtlmoon

* Apply suggestion from @dgtlmoon

* Only render request headers/body at fetch time when they contain Jinja2, drop FORCE_COLOR changes

The edit form now skips Jinja2 validation for text like {%22 that is not a template,
but processors/base.py still rendered every header and the body unconditionally, so
a body such as q={%22key%22:1} was accepted on save and then failed every check with
a TemplateSyntaxError. Use JINJA2_MARKER_PATTERN there too, so it is sent as-is.

Also reset the CI workflow and run_*_tests.sh scripts to master, the FORCE_COLOR
changes are unrelated to this fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: dgtlmoon <dgtlmoon@gmail.com>
Co-authored-by: dgtlmoon <leigh@morresi.net>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-23 15:32:32 +02:00

30 lines
667 B
Python

"""
Jinja2 custom extensions and safe rendering utilities.
"""
import re
from .extensions.TimeExtension import TimeExtension
from .safe_jinja import (
render,
render_fully_escaped,
create_jinja_env,
JINJA2_MAX_RETURN_PAYLOAD_SIZE,
DEFAULT_JINJA2_EXTENSIONS,
)
from .plugins.regex import regex_replace
from .plugins.datetime_fmt import unixtime
JINJA2_MARKER_PATTERN = re.compile(r'{%[-+]?\s*[a-zA-Z_]|{{')
__all__ = [
'TimeExtension',
'render',
'render_fully_escaped',
'create_jinja_env',
'JINJA2_MAX_RETURN_PAYLOAD_SIZE',
'DEFAULT_JINJA2_EXTENSIONS',
'regex_replace',
'JINJA2_MARKER_PATTERN',
'unixtime',
]