From d206b1b47bfc2a07d03baee14f5ff7eb2bfabdc9 Mon Sep 17 00:00:00 2001 From: karrisanthoshigayatri Date: Sat, 11 Jul 2026 16:14:04 +0530 Subject: [PATCH] plugin_validator skips placeholder validation inside --if tokens #1801 --- backend/secuscan/plugin_validator.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/backend/secuscan/plugin_validator.py b/backend/secuscan/plugin_validator.py index 0a9fe955b..e188ed356 100644 --- a/backend/secuscan/plugin_validator.py +++ b/backend/secuscan/plugin_validator.py @@ -186,6 +186,24 @@ def _check_command_template(self, data: dict, result: ValidationResult) -> None: continue if token.startswith("--if:"): + # --if tokens have the form: + # --if::then:[:else:] + # Extract then/else segments so placeholders inside them are + # still validated against declared field ids. + parts = token.split(":") + # Find 'then' and 'else' markers and collect the segments after them + segments_to_check: list[str] = [] + for j, part in enumerate(parts): + if part in ("then", "else") and j + 1 < len(parts): + segments_to_check.append(parts[j + 1]) + for segment in segments_to_check: + for match in placeholder_re.finditer(segment): + var_name = match.group(1) + if known_field_ids and var_name not in known_field_ids: + result.add( + f"command_template[{i}]", + f"Placeholder '{{{var_name}}}' inside --if token does not match any declared field id", + ) continue for match in placeholder_re.finditer(token):