fd5f6a74f1
The final branch of _XXE_INJECTION was missing % separators between hex pairs. Pattern %(?:25)?53(?:25)?59... never matched because after consuming %53 the next sub-pattern expected 5 or 2, not %. Fixed by inserting % anchors between each pair so both single-encoded (%53%59%53%54%45%4D) and double-encoded (%2553%2559...) SYSTEM strings match correctly. All existing XXE branches are unaffected. |
||
|---|---|---|
| .. | ||
| api | ||
| core | ||
| models | ||
| schemas | ||
| services | ||
| __init__.py | ||
| __main__.py | ||
| config.py | ||
| factory.py | ||
| main.py | ||