lukaszraczylo 48a19e04f8 fix(settings): tolerate whitespace in header template delimiters (#148) ...

validateTemplateSecure matched safe functions with literal strings.Contains
("{{get "), so a space after {{ ("{{ get") failed the whitelist and
Config.Validate() rejected the config, surfacing as Traefik's opaque
"invalid handler type: <nil>". Go's text/template treats {{ get and {{get
identically, so the validator was stricter than the engine.

Normalize inner-delimiter whitespace before matching. This also closes a
security gap where a leading space let dangerous patterns ("{{ range",
"{{ call") evade detection.

Adds unit + regression coverage.

2026-06-26 11:49:31 +01:00

..

regression_test.go

fix(settings): tolerate whitespace in header template delimiters (#148)

2026-06-26 11:49:31 +01:00