medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge commit from fork 

security: GHSA-7fq5-7wr8-rjwj (HIGH) Shared template instances could …
This commit is contained in:
James Read 2026-05-21 23:57:01 +01:00 committed by GitHub
parent 75b9581835 d74da93140
commit 9ea01bbd0b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
service/internal/tpl/templates.go
View File

@ -24,6 +24,8 @@ func jsonFunc(v any) (string, error) {
return string(data), nil return string(data), nil
} }
// Root template (funcs/options). parseTemplate clones before Parse — text/template
// must not receive concurrent Parse calls on the same instance.
var tpl = template.New("tpl"). var tpl = template.New("tpl").
Option("missingkey=error"). Option("missingkey=error").
Funcs(template.FuncMap{"Json": jsonFunc}) Funcs(template.FuncMap{"Json": jsonFunc})
@ -179,7 +181,12 @@ func checkMissingArgumentError(err error) (bool, string) {
} }
func parseTemplate(source string, data any) (string, error) { func parseTemplate(source string, data any) (string, error) {
t, err := tpl.Parse(source) clone, err := tpl.Clone()
if err != nil {
return "", err
}
t, err := clone.Parse(source)
if err != nil { if err != nil {
return "", err return "", err