avoid potential RegExp denial-of-service (#5135)

closes #5133
closes #5134

lib/utils.js

@@ -143,7 +143,7 @@ function push_uniq(array, el) {
 }
 
 function string_template(text, props) {
-    return text.replace(/\{([^}]+)\}/g, function(str, p) {
+    return text.replace(/\{([^{}]+)\}/g, function(str, p) {
         var value = props[p];
         return value instanceof AST_Node ? value.print_to_string() : value;
     });