fix(security): align tag pattern with codebase standard [^<>]+ pattern

waleedlatif1 · waleedlatif1 · commit dc4125116a4d · 2026-04-13T20:08:17.000-07:00
Matches createReferencePattern() from reference-validation.ts used by the
core executor. Invalid refs handled gracefully by resolveBlockReference.
diff --git a/apps/sim/app/api/function/execute/route.ts b/apps/sim/app/api/function/execute/route.ts
@@ -28,7 +28,7 @@ export const MAX_DURATION = 210
 const logger = createLogger('FunctionExecuteAPI')
 
 const TAG_PATTERN = new RegExp(
-  `${REFERENCE.START}([a-zA-Z_](?:\\${REFERENCE.PATH_DELIMITER}[a-zA-Z0-9_]+|[a-zA-Z0-9_])*)${REFERENCE.END}`,
+  `${REFERENCE.START}([^${REFERENCE.START}${REFERENCE.END}]+)${REFERENCE.END}`,
   'g'
 )
 

Original file line number	Diff line number	Diff line change
`@@ -28,7 +28,7 @@ export const MAX_DURATION = 210`
`28`	`28`	`const logger = createLogger('FunctionExecuteAPI')`
`29`	`29`
`30`	`30`	`const TAG_PATTERN = new RegExp(`
`31`		- `${REFERENCE.START}([a-zA-Z_](?:\\${REFERENCE.PATH_DELIMITER}[a-zA-Z0-9_]+\|[a-zA-Z0-9_])*)${REFERENCE.END}`,
	`31`	+ `${REFERENCE.START}([^${REFERENCE.START}${REFERENCE.END}]+)${REFERENCE.END}`,
`32`	`32`	`'g'`
`33`	`33`	`)`
`34`	`34`