fix: replace HTMLParser template rendering with regex substitution

HTMLParser treats <TITLE> and other raw text elements as opaque —
child tags like <condata> inside <TITLE> are passed to handle_data()
as raw text rather than being parsed as tags. This caused template
variables to leak into HTTP responses verbatim, allowing trivial
honeypot fingerprinting.

Replace substitute_template_fields() with a regex-based approach that
scans the full payload for <condata source='...' key='...' /> patterns
regardless of surrounding HTML context.

Before: <TITLE>Overview - <condata source="databus" key="SystemDescription" /></TITLE>
After:  <TITLE>Overview - Siemens, SIMATIC, S7-200</TITLE>

Fixes #1

Author: ethan-thomason

conpot/protocols/http/command_responder.py

@@ -19,6 +19,7 @@
 import time
 import random
 import os
+import re
 
 from datetime import datetime
 
@@ -177,14 +178,26 @@ def send_response(self, code, message=None):
         # - self.send_header('Date', self.date_time_string())
 
     def substitute_template_fields(self, payload):
-        # initialize parser with our payload
-        parser = TemplateParser(payload)
-
-        # triggers the parser, just in case of open / incomplete tags..
-        parser.close()
-
-        # retrieve and return (substituted) payload
-        return parser.payload
+        if type(payload) == bytes:
+            payload = payload.decode()
+        databus = conpot_core.get_databus()
+        pattern = r'<condata\s+source="([^"]+)"\s+key="([^"]+)"\s*/>'
+
+        def replacer(match):
+            source = match.group(1)
+            key = match.group(2)
+            if source == "databus":
+                result = databus.get_value(key)
+                return str(result) if result is not None else match.group(0)
+            elif source == "eval":
+                try:
+                    return str(eval(key))
+                except Exception as e:
+                    logger.exception(e)
+                    return match.group(0)
+            return match.group(0)
+
+        return re.sub(pattern, replacer, payload)
 
     def load_status(
         self,