diff options
| author | Michal Bohuslávek <mbohuslavek@gmail.com> | 2015-09-02 19:05:22 +0200 |
|---|---|---|
| committer | Russ Cox <rsc@golang.org> | 2015-11-25 17:08:38 +0000 |
| commit | 97c859f8da0c85c33d0f29ba5e11094d8e691e87 (patch) | |
| tree | 20794c155502b2242a2e3e132d18017d4aa87217 /src/encoding/xml/xml.go | |
| parent | 3f6b91b1136e25e75da71b727e536ba4f4066fd5 (diff) | |
| download | go-97c859f8da0c85c33d0f29ba5e11094d8e691e87.tar.xz | |
encoding/xml: reject invalid comments
Fixes #11112.
Change-Id: I16e7363549a0dec8c61addfa14af0866c1fd7c40
Reviewed-on: https://go-review.googlesource.com/14173
Reviewed-by: Russ Cox <rsc@golang.org>
Diffstat (limited to 'src/encoding/xml/xml.go')
| -rw-r--r-- | src/encoding/xml/xml.go | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/encoding/xml/xml.go b/src/encoding/xml/xml.go index bd766a6934..bdd607cfa8 100644 --- a/src/encoding/xml/xml.go +++ b/src/encoding/xml/xml.go @@ -624,7 +624,12 @@ func (d *Decoder) rawToken() (Token, error) { return nil, d.err } d.buf.WriteByte(b) - if b0 == '-' && b1 == '-' && b == '>' { + if b0 == '-' && b1 == '-' { + if b != '>' { + d.err = d.syntaxError( + `invalid sequence "--" not allowed in comments`) + return nil, d.err + } break } b0, b1 = b1, b |