diff options
| author | Nigel Tao <nigeltao@golang.org> | 2012-04-12 09:35:43 +1000 |
|---|---|---|
| committer | Nigel Tao <nigeltao@golang.org> | 2012-04-12 09:35:43 +1000 |
| commit | 6277656d69640da9166bbac2a132a3ddee61dcac (patch) | |
| tree | 6f4080c783f61ea8edd829c8afb329d9ee408628 /src/pkg | |
| parent | 772e8ff4584ac6b97d8f3c38f0b21161ca72fe81 (diff) | |
| download | go-6277656d69640da9166bbac2a132a3ddee61dcac.tar.xz | |
html, exp/html: escape ' and " as ' and ", since IE8 and
below do not support '.
This makes package html consistent with package text/template's
HTMLEscape function.
Fixes #3489.
R=rsc, mikesamuel, dsymonds
CC=golang-dev
https://golang.org/cl/5992071
Diffstat (limited to 'src/pkg')
| -rw-r--r-- | src/pkg/exp/html/escape.go | 8 | ||||
| -rw-r--r-- | src/pkg/exp/html/render_test.go | 2 | ||||
| -rw-r--r-- | src/pkg/exp/html/token_test.go | 11 | ||||
| -rw-r--r-- | src/pkg/html/escape.go | 8 | ||||
| -rw-r--r-- | src/pkg/net/http/server.go | 6 | ||||
| -rw-r--r-- | src/pkg/text/template/funcs.go | 2 |
6 files changed, 22 insertions, 15 deletions
diff --git a/src/pkg/exp/html/escape.go b/src/pkg/exp/html/escape.go index 8f62a8c288..c177a66068 100644 --- a/src/pkg/exp/html/escape.go +++ b/src/pkg/exp/html/escape.go @@ -205,13 +205,15 @@ func escape(w writer, s string) error { case '&': esc = "&" case '\'': - esc = "'" + // "'" is shorter than "'" and apos was not in HTML until HTML5. + esc = "'" case '<': esc = "<" case '>': esc = ">" case '"': - esc = """ + // """ is shorter than """. + esc = """ default: panic("unrecognized escape character") } @@ -226,7 +228,7 @@ func escape(w writer, s string) error { } // EscapeString escapes special characters like "<" to become "<". It -// escapes only five such characters: amp, apos, lt, gt and quot. +// escapes only five such characters: <, >, &, ' and ". // UnescapeString(EscapeString(s)) == s always holds, but the converse isn't // always true. func EscapeString(s string) string { diff --git a/src/pkg/exp/html/render_test.go b/src/pkg/exp/html/render_test.go index 0584f35abd..a2e205275d 100644 --- a/src/pkg/exp/html/render_test.go +++ b/src/pkg/exp/html/render_test.go @@ -98,7 +98,7 @@ func TestRenderer(t *testing.T) { }, }, } - want := `<html><head></head><body>0<1<p id="A" foo="abc"def">` + + want := `<html><head></head><body>0<1<p id="A" foo="abc"def">` + `2<b empty="">3</b><i backslash="\">&4</i></p>` + `5<blockquote></blockquote><br/>6</body></html>` b := new(bytes.Buffer) diff --git a/src/pkg/exp/html/token_test.go b/src/pkg/exp/html/token_test.go index 61d74006ea..4e6eca93c5 100644 --- a/src/pkg/exp/html/token_test.go +++ b/src/pkg/exp/html/token_test.go @@ -359,7 +359,7 @@ var tokenTests = []tokenTest{ { "tricky", "<p \t\n iD=\"a"B\" foo=\"bar\"><EM>te<&;xt</em></p>", - `<p id="a"B" foo="bar">$<em>$te<&;xt$</em>$</p>`, + `<p id="a"B" foo="bar">$<em>$te<&;xt$</em>$</p>`, }, // A nonexistent entity. Tokenizing and converting back to a string should // escape the "&" to become "&". @@ -421,7 +421,7 @@ var tokenTests = []tokenTest{ { "Double-quoted attribute value", `<input value="I'm an attribute" FOO="BAR">`, - `<input value="I'm an attribute" foo="BAR">`, + `<input value="I'm an attribute" foo="BAR">`, }, { "Attribute name characters", @@ -436,7 +436,7 @@ var tokenTests = []tokenTest{ { "Attributes with a solitary single quote", `<p id=can't><p id=won't>`, - `<p id="can't">$<p id="won't">`, + `<p id="can't">$<p id="won't">`, }, } @@ -545,10 +545,11 @@ func TestUnescapeEscape(t *testing.T) { `"<&>"`, `"<&>"`, `3&5==1 && 0<1, "0<1", a+acute=á`, + `The special characters are: <, >, &, ' and "`, } for _, s := range ss { - if s != UnescapeString(EscapeString(s)) { - t.Errorf("s != UnescapeString(EscapeString(s)), s=%q", s) + if got := UnescapeString(EscapeString(s)); got != s { + t.Errorf("got %q want %q", got, s) } } } diff --git a/src/pkg/html/escape.go b/src/pkg/html/escape.go index fee771a578..24cb7af852 100644 --- a/src/pkg/html/escape.go +++ b/src/pkg/html/escape.go @@ -210,13 +210,15 @@ func escape(w writer, s string) error { case '&': esc = "&" case '\'': - esc = "'" + // "'" is shorter than "'" and apos was not in HTML until HTML5. + esc = "'" case '<': esc = "<" case '>': esc = ">" case '"': - esc = """ + // """ is shorter than """. + esc = """ default: panic("unrecognized escape character") } @@ -231,7 +233,7 @@ func escape(w writer, s string) error { } // EscapeString escapes special characters like "<" to become "<". It -// escapes only five such characters: amp, apos, lt, gt and quot. +// escapes only five such characters: <, >, &, ' and ". // UnescapeString(EscapeString(s)) == s always holds, but the converse isn't // always true. func EscapeString(s string) string { diff --git a/src/pkg/net/http/server.go b/src/pkg/net/http/server.go index 228ac40196..924ffd3481 100644 --- a/src/pkg/net/http/server.go +++ b/src/pkg/net/http/server.go @@ -785,8 +785,10 @@ var htmlReplacer = strings.NewReplacer( "&", "&", "<", "<", ">", ">", - `"`, """, - "'", "'", + // """ is shorter than """. + `"`, """, + // "'" is shorter than "'" and apos was not in HTML until HTML5. + "'", "'", ) func htmlEscape(s string) string { diff --git a/src/pkg/text/template/funcs.go b/src/pkg/text/template/funcs.go index 525179cb49..8fbf0ef50a 100644 --- a/src/pkg/text/template/funcs.go +++ b/src/pkg/text/template/funcs.go @@ -246,7 +246,7 @@ func not(arg interface{}) (truth bool) { var ( htmlQuot = []byte(""") // shorter than """ - htmlApos = []byte("'") // shorter than "'" + htmlApos = []byte("'") // shorter than "'" and apos was not in HTML until HTML5 htmlAmp = []byte("&") htmlLt = []byte("<") htmlGt = []byte(">") |