aboutsummaryrefslogtreecommitdiff
path: root/src/html/template/js.go
AgeCommit message (Collapse)Author
2024-12-10html/template: escape script tags in JS errors case insensitivelyRoland Shoemaker
Thanks to Juho Forsén of Mattermost for reporting this issue. Fixes #70740 Change-Id: I1a49b199dee91cd2bb4df5b174aaa958dc040c18 Reviewed-on: https://go-review.googlesource.com/c/go/+/634696 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-03-26all: fix a large number of commentscui fliter
Partial typo corrections, following https://go.dev/wiki/Spelling Change-Id: I2357906ff2ea04305c6357418e4e9556e20375d1 Reviewed-on: https://go-review.googlesource.com/c/go/+/573776 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Than McIntosh <thanm@google.com> Run-TryBot: shuang cui <imcusg@gmail.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com>
2024-02-27html/template: escape additional tokens in MarshalJSON errorsRoland Shoemaker
Escape "</script" and "<!--" in errors returned from MarshalJSON errors when attempting to marshal types in script blocks. This prevents any user controlled content from prematurely terminating the script block. Fixes #65697 Change-Id: Icf0e26c54ea7d9c1deed0bff11b6506c99ddef1b Reviewed-on: https://go-review.googlesource.com/c/go/+/564196 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2023-10-02html/template: support parsing complex JS template literalsRoland Shoemaker
This change undoes the restrictions added in CL 482079, which added a blanket ban on using actions within JS template literal strings, and adds logic to support actions while properly applies contextual escaping based on the correct context within the literal. Since template literals can contain both normal strings, and nested JS contexts, logic is required to properly track those context switches during parsing. ErrJsTmplLit is deprecated, and the GODEBUG flag jstmpllitinterp no longer does anything. Fixes #61619 Change-Id: I0338cc6f663723267b8f7aaacc55aa28f60906f2 Reviewed-on: https://go-review.googlesource.com/c/go/+/507995 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Roland Shoemaker <roland@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2023-08-01text/template, html/template: use reflect.TypeFor for known typesIan Lance Taylor
For #60088 Change-Id: Ibc3983ca5cfe396087ddfa96c43cfe32ca47129a Reviewed-on: https://go-review.googlesource.com/c/go/+/514640 Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Daniel Martí <mvdan@mvdan.cc> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Rob Pike <r@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com>
2023-05-02html/template: handle all JS whitespace charactersRoland Shoemaker
Rather than just a small set. Character class as defined by \s [0]. Thanks to Juho Nurminen of Mattermost for reporting this. Fixes #59721 Fixes CVE-2023-24540 [0] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions/Character_Classes Change-Id: I56d4fa1ef08125b417106ee7dbfb5b0923b901ba Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1821459 Reviewed-by: Julie Qiu <julieqiu@google.com> Run-TryBot: Roland Shoemaker <bracewell@google.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/491616 Run-TryBot: Carlos Amedee <carlos@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2023-04-04html/template: disallow actions in JS template literalsRoland Shoemaker
ECMAScript 6 introduced template literals[0][1] which are delimited with backticks. These need to be escaped in a similar fashion to the delimiters for other string literals. Additionally template literals can contain special syntax for string interpolation. There is no clear way to allow safe insertion of actions within JS template literals, as handling (JS) string interpolation inside of these literals is rather complex. As such we've chosen to simply disallow template actions within these template literals. A new error code is added for this parsing failure case, errJsTmplLit, but it is unexported as it is not backwards compatible with other minor release versions to introduce an API change in a minor release. We will export this code in the next major release. The previous behavior (with the cavet that backticks are now escaped properly) can be re-enabled with GODEBUG=jstmpllitinterp=1. This change subsumes CL471455. Thanks to Sohom Datta, Manipal Institute of Technology, for reporting this issue. Fixes CVE-2023-24538 Fixes #59234 [0] https://tc39.es/ecma262/multipage/ecmascript-language-expressions.html#sec-template-literals [1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802457 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> Reviewed-by: Roland Shoemaker <bracewell@google.com> Change-Id: Ia221fefdb273bd0f066dffc2abcf2a616801d2f2 Reviewed-on: https://go-review.googlesource.com/c/go/+/482079 TryBot-Bypass: Michael Knyszek <mknyszek@google.com> Run-TryBot: Michael Knyszek <mknyszek@google.com> Reviewed-by: Matthew Dempsky <mdempsky@google.com> Auto-Submit: Michael Knyszek <mknyszek@google.com>
2021-12-13all: gofmt -w -r 'interface{} -> any' srcRuss Cox
And then revert the bootstrap cmd directories and certain testdata. And adjust tests as needed. Not reverting the changes in std that are bootstrapped, because some of those changes would appear in API docs, and we want to use any consistently. Instead, rewrite 'any' to 'interface{}' in cmd/dist for those directories when preparing the bootstrap copy. A few files changed as a result of running gofmt -w not because of interface{} -> any but because they hadn't been updated for the new //go:build lines. Fixes #49884. Change-Id: Ie8045cba995f65bd79c694ec77a1b3d1fe01bb09 Reviewed-on: https://go-review.googlesource.com/c/go/+/368254 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Robert Griesemer <gri@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2021-10-26all: use reflect.{Pointer,PointerTo}Cuong Manh Le
Updates #47651 Updates #48665 Change-Id: I69a87b45a5cad7a07fbd855040cd9935cf874554 Reviewed-on: https://go-review.googlesource.com/c/go/+/358454 Trust: Cuong Manh Le <cuong.manhle.vn@gmail.com> Run-TryBot: Cuong Manh Le <cuong.manhle.vn@gmail.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2021-10-06all: use bytes.Cut, strings.CutRuss Cox
Many uses of Index/IndexByte/IndexRune/Split/SplitN can be written more clearly using the new Cut functions. Do that. Also rewrite to other functions if that's clearer. For #46336. Change-Id: I68d024716ace41a57a8bf74455c62279bde0f448 Reviewed-on: https://go-review.googlesource.com/c/go/+/351711 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-04-16html/template,text/template: switch to Unicode escapes for JSON compatibilityempijei
The existing implementation is not compatible with JSON escape as it uses hex escaping. Unicode escape, instead, is valid for both JSON and JS. This fix avoids creating a separate escaping context for scripts of type "application/ld+json" and it is more future-proof in case more JSON+JS contexts get added to the platform (e.g. import maps). Fixes #33671 Fixes #37634 Change-Id: Id6f6524b4abc52e81d9d744d46bbe5bf2e081543 Reviewed-on: https://go-review.googlesource.com/c/go/+/226097 Reviewed-by: Carl Johnson <me@carlmjohnson.net> Reviewed-by: Daniel Martí <mvdan@mvdan.cc> Run-TryBot: Daniel Martí <mvdan@mvdan.cc> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-08-27html/template: micro optimization for isJSTypeDong-hee Na
There is an unnecessary lower operation in isJSType. Simple logic fix can improve tiny performance. name old time/op new time/op delta isJSType-8 152ns ± 0% 58ns ± 7% -61.82% (p=0.001 n=6+8) name old alloc/op new alloc/op delta isJSType-8 32.0B ± 0% 0.0B -100.00% (p=0.000 n=8+8) name old allocs/op new allocs/op delta isJSType-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=8+8) Change-Id: I281aadf1677d4377920c9649af206381189a27e6 Reviewed-on: https://go-review.googlesource.com/c/go/+/177118 Run-TryBot: Daniel Martí <mvdan@mvdan.cc> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Daniel Martí <mvdan@mvdan.cc>
2019-05-06html/template: add support for JavaScript modulesAndrew Bonventre
html/template does not properly treat JavaScript code as JavaScript when using a <script> tag with "module" set as the type attribute. See also: https://www.w3.org/TR/html5/semantics-scripting.html#element-attrdef-script-type and https://html.spec.whatwg.org/multipage/scripting.html#the-script-element:module-script-2 Original change from tomut at https://golang.org/cl/135417 Fixes #31327 Change-Id: I6239be69cd7994990d091400664e4474124a98fc Reviewed-on: https://go-review.googlesource.com/c/go/+/175218 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-02-26html/template: use strings.BuilderJosh Bleecher Snyder
...and size initial buffers more accurately. Easy pickings only. More might remain. name old time/op new time/op delta CSSEscaper-8 1.17µs ± 1% 0.80µs ± 2% -31.55% (p=0.000 n=44+48) CSSEscaperNoSpecials-8 205ns ± 2% 204ns ± 3% -0.73% (p=0.014 n=46+49) DecodeCSS-8 438ns ± 2% 436ns ± 2% ~ (p=0.099 n=48+47) DecodeCSSNoSpecials-8 6.11ns ± 3% 5.93ns ± 3% -2.85% (p=0.000 n=50+48) CSSValueFilter-8 149ns ± 0% 145ns ± 0% -2.68% (p=0.000 n=32+35) CSSValueFilterOk-8 238ns ± 2% 234ns ± 2% -1.40% (p=0.000 n=49+47) EscapedExecute-8 2.53µs ± 2% 2.55µs ± 1% +0.87% (p=0.000 n=48+49) HTMLNospaceEscaper-8 1.35µs ± 2% 0.92µs ± 1% -31.74% (p=0.000 n=48+48) HTMLNospaceEscaperNoSpecials-8 278ns ± 2% 263ns ± 2% -5.17% (p=0.000 n=47+49) StripTags-8 778ns ± 2% 786ns ± 1% +0.96% (p=0.000 n=46+47) StripTagsNoSpecials-8 84.2ns ± 1% 84.1ns ± 1% ~ (p=0.300 n=48+48) JSValEscaperWithNum-8 506ns ± 2% 486ns ± 3% -3.82% (p=0.000 n=47+45) JSValEscaperWithStr-8 1.61µs ± 1% 1.64µs ± 1% +1.75% (p=0.000 n=44+49) JSValEscaperWithStrNoSpecials-8 548ns ± 2% 552ns ± 2% +0.78% (p=0.000 n=48+46) JSValEscaperWithObj-8 1.91µs ± 2% 1.87µs ± 1% -2.08% (p=0.000 n=49+47) JSValEscaperWithObjNoSpecials-8 735ns ± 2% 742ns ± 2% +1.01% (p=0.000 n=47+49) JSStrEscaperNoSpecials-8 228ns ± 4% 211ns ± 3% -7.53% (p=0.000 n=50+49) JSStrEscaper-8 1.11µs ± 1% 0.78µs ± 1% -29.94% (p=0.000 n=48+48) JSRegexpEscaperNoSpecials-8 214ns ± 2% 212ns ± 3% -1.12% (p=0.000 n=50+49) JSRegexpEscaper-8 1.17µs ± 0% 0.79µs ± 1% -31.92% (p=0.000 n=48+47) TemplateSpecialTags-8 172µs ± 1% 172µs ± 1% ~ (p=0.976 n=48+47) URLEscaper-8 1.88µs ± 2% 1.87µs ± 2% -0.56% (p=0.001 n=49+49) URLEscaperNoSpecials-8 162ns ± 1% 169ns ± 1% +3.76% (p=0.000 n=49+50) URLNormalizer-8 1.29µs ± 3% 1.29µs ± 2% -0.37% (p=0.041 n=48+48) URLNormalizerNoSpecials-8 185ns ± 1% 186ns ± 1% +0.15% (p=0.013 n=49+49) SrcsetFilter-8 616ns ± 1% 618ns ± 1% +0.36% (p=0.000 n=46+46) SrcsetFilterNoSpecials-8 359ns ± 0% 352ns ± 0% -1.93% (p=0.000 n=40+43) [Geo mean] 560ns 525ns -6.17% name old alloc/op new alloc/op delta CSSEscaper-8 672B ± 0% 336B ± 0% -50.00% (p=0.000 n=50+50) CSSEscaperNoSpecials-8 0.00B 0.00B ~ (all equal) DecodeCSS-8 160B ± 0% 160B ± 0% ~ (all equal) DecodeCSSNoSpecials-8 0.00B 0.00B ~ (all equal) CSSValueFilter-8 96.0B ± 0% 96.0B ± 0% ~ (all equal) CSSValueFilterOk-8 48.0B ± 0% 48.0B ± 0% ~ (all equal) EscapedExecute-8 688B ± 0% 624B ± 0% -9.30% (p=0.000 n=50+50) HTMLNospaceEscaper-8 752B ± 0% 368B ± 0% -51.06% (p=0.000 n=50+50) HTMLNospaceEscaperNoSpecials-8 48.0B ± 0% 32.0B ± 0% -33.33% (p=0.000 n=50+50) StripTags-8 224B ± 0% 224B ± 0% ~ (all equal) StripTagsNoSpecials-8 112B ± 0% 112B ± 0% ~ (all equal) JSValEscaperWithNum-8 96.0B ± 0% 40.0B ± 0% -58.33% (p=0.000 n=50+50) JSValEscaperWithStr-8 384B ± 0% 384B ± 0% ~ (all equal) JSValEscaperWithStrNoSpecials-8 96.0B ± 0% 96.0B ± 0% ~ (all equal) JSValEscaperWithObj-8 448B ± 0% 448B ± 0% ~ (all equal) JSValEscaperWithObjNoSpecials-8 160B ± 0% 160B ± 0% ~ (all equal) JSStrEscaperNoSpecials-8 0.00B 0.00B ~ (all equal) JSStrEscaper-8 672B ± 0% 336B ± 0% -50.00% (p=0.000 n=50+50) JSRegexpEscaperNoSpecials-8 0.00B 0.00B ~ (all equal) JSRegexpEscaper-8 672B ± 0% 336B ± 0% -50.00% (p=0.000 n=50+50) TemplateSpecialTags-8 48.0kB ± 0% 47.9kB ± 0% -0.13% (p=0.000 n=50+48) URLEscaper-8 336B ± 0% 336B ± 0% ~ (all equal) URLEscaperNoSpecials-8 112B ± 0% 112B ± 0% ~ (all equal) URLNormalizer-8 176B ± 0% 176B ± 0% ~ (all equal) URLNormalizerNoSpecials-8 112B ± 0% 112B ± 0% ~ (all equal) SrcsetFilter-8 160B ± 0% 160B ± 0% ~ (all equal) SrcsetFilterNoSpecials-8 160B ± 0% 160B ± 0% ~ (all equal) [Geo mean] 259B 216B -16.60% name old allocs/op new allocs/op delta CSSEscaper-8 4.00 ± 0% 2.00 ± 0% -50.00% (p=0.000 n=50+50) CSSEscaperNoSpecials-8 0.00 0.00 ~ (all equal) DecodeCSS-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) DecodeCSSNoSpecials-8 0.00 0.00 ~ (all equal) CSSValueFilter-8 2.00 ± 0% 2.00 ± 0% ~ (all equal) CSSValueFilterOk-8 3.00 ± 0% 3.00 ± 0% ~ (all equal) EscapedExecute-8 18.0 ± 0% 18.0 ± 0% ~ (all equal) HTMLNospaceEscaper-8 5.00 ± 0% 3.00 ± 0% -40.00% (p=0.000 n=50+50) HTMLNospaceEscaperNoSpecials-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) StripTags-8 3.00 ± 0% 3.00 ± 0% ~ (all equal) StripTagsNoSpecials-8 2.00 ± 0% 2.00 ± 0% ~ (all equal) JSValEscaperWithNum-8 3.00 ± 0% 3.00 ± 0% ~ (all equal) JSValEscaperWithStr-8 2.00 ± 0% 2.00 ± 0% ~ (all equal) JSValEscaperWithStrNoSpecials-8 2.00 ± 0% 2.00 ± 0% ~ (all equal) JSValEscaperWithObj-8 3.00 ± 0% 3.00 ± 0% ~ (all equal) JSValEscaperWithObjNoSpecials-8 3.00 ± 0% 3.00 ± 0% ~ (all equal) JSStrEscaperNoSpecials-8 0.00 0.00 ~ (all equal) JSStrEscaper-8 4.00 ± 0% 2.00 ± 0% -50.00% (p=0.000 n=50+50) JSRegexpEscaperNoSpecials-8 0.00 0.00 ~ (all equal) JSRegexpEscaper-8 4.00 ± 0% 2.00 ± 0% -50.00% (p=0.000 n=50+50) TemplateSpecialTags-8 185 ± 0% 185 ± 0% ~ (all equal) URLEscaper-8 4.00 ± 0% 4.00 ± 0% ~ (all equal) URLEscaperNoSpecials-8 2.00 ± 0% 2.00 ± 0% ~ (all equal) URLNormalizer-8 3.00 ± 0% 3.00 ± 0% ~ (all equal) URLNormalizerNoSpecials-8 2.00 ± 0% 2.00 ± 0% ~ (all equal) SrcsetFilter-8 3.00 ± 0% 3.00 ± 0% ~ (all equal) SrcsetFilterNoSpecials-8 3.00 ± 0% 3.00 ± 0% ~ (all equal) [Geo mean] 3.41 3.05 -10.65% Change-Id: I809ea56495ce1881656af7e24621448ab64b449a Reviewed-on: https://go-review.googlesource.com/c/155919 Run-TryBot: Josh Bleecher Snyder <josharian@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-12-13text/html: escape MIME type "application/ld+json" as JavaScriptEvan Klitzke
Fixes #26053 Change-Id: Ic2052b1d0d4e0826a217a520c83d7bb0995ea72a GitHub-Last-Rev: 5a3eea3dd22b0a194591ce2294b88cb340df1e8d GitHub-Pull-Request: golang/go#26054 Reviewed-on: https://go-review.googlesource.com/c/120835 Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2018-11-02all: use "reports whether" consistently in the few places that didn'tBrad Fitzpatrick
Go documentation style for boolean funcs is to say: // Foo reports whether ... func Foo() bool (rather than "returns true if") This CL also replaces 4 uses of "iff" with the same "reports whether" wording, which doesn't lose any meaning, and will prevent people from sending typo fixes when they don't realize it's "if and only if". In the past I think we've had the typo CLs updated to just say "reports whether". So do them all at once. (Inspired by the addition of another "returns true if" in CL 146938 in fd_plan9.go) Created with: $ perl -i -npe 's/returns true if/reports whether/' $(git grep -l "returns true iff" | grep -v vendor) $ perl -i -npe 's/returns true if/reports whether/' $(git grep -l "returns true if" | grep -v vendor) Change-Id: Ided502237f5ab0d25cb625dbab12529c361a8b9f Reviewed-on: https://go-review.googlesource.com/c/147037 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2018-09-26all: use strings.ReplaceAll and bytes.ReplaceAll where applicableBrad Fitzpatrick
I omitted vendor directories and anything necessary for bootstrapping. (Tested by bootstrapping with Go 1.4) Updates #27864 Change-Id: I7d9b68d0372d3a34dee22966cca323513ece7e8a Reviewed-on: https://go-review.googlesource.com/137856 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2018-06-01all: update comment URLs from HTTP to HTTPS, where possibleTim Cooper
Each URL was manually verified to ensure it did not serve up incorrect content. Change-Id: I4dc846227af95a73ee9a3074d0c379ff0fa955df Reviewed-on: https://go-review.googlesource.com/115798 Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org>
2018-05-09html/template: always write untyped nil as JS nullDaniel Martí
text/template recently added support for passing untyped nil as function call arguments, as those would be mixed up with "missing argument" values before. See CL 95215. html/template now needs a small change to adapt to that new possibility. In particular, when printing values as JS bytes, its code was written under the assumption that the values would never be untyped nil - that is, the reflect.Value would always be valid. Short-circuit indirectToJSONMarshaler on an untyped nil, to avoid the panic and fall back to the existing " null " output. Before this change and on 1.10, printing a typed nil and an untyped nil resulted in: null "" After this change, one will get: null null Fixes #24717. Change-Id: I03cd10ef64b96e837bacc9ccf4cf25624d80de1c Reviewed-on: https://go-review.googlesource.com/109215 Run-TryBot: Daniel Martí <mvdan@mvdan.cc> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Rhys Hiltner <rhys@justin.tv> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-10-05all: revert "all: prefer strings.IndexByte over strings.Index"Marvin Stenger
This reverts https://golang.org/cl/65930. Fixes #22148 Change-Id: Ie0712621ed89c43bef94417fc32de9af77607760 Reviewed-on: https://go-review.googlesource.com/68430 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-09-25all: prefer strings.IndexByte over strings.IndexMarvin Stenger
strings.IndexByte was introduced in go1.2 and it can be used effectively wherever the second argument to strings.Index is exactly one byte long. This avoids generating unnecessary string symbols and saves a few calls to strings.Index. Change-Id: I1ab5edb7c4ee9058084cfa57cbcc267c2597e793 Reviewed-on: https://go-review.googlesource.com/65930 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-04-20html/template: ensure that MIME type handling is case insensitiveSamuel Tan
Handle MIME types found in the type attribute of the script element in a case insensitive way, as per Section 5.1 of RFC 2045. Fixes #19968 Change-Id: Ie1416178c937dcf2c96bcec4191cebe7c3477af8 Reviewed-on: https://go-review.googlesource.com/40702 Reviewed-by: Russ Cox <rsc@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-12-04html/template: escape JS in application/json script tagNodir Turakulov
Since ffd1c781b77aab542713b66ef387fa9307e4060b HTML templates check MIME type in the "type" attribute of "script" tag to decide if contents should be escaped as JavaScript. The whitelist of MIME types did not include application/json. Include it in this CL. Fixes #18159 Change-Id: I17a8a38f2b7789b4b7e941d14279de222eaf2b6a Reviewed-on: https://go-review.googlesource.com/33899 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-11-12all: spell "marshal" and "unmarshal" consistentlyDmitri Shuralyov
The tree is inconsistent about single l vs double l in those words in documentation, test messages, and one error value text. $ git grep -E '[Mm]arshall(|s|er|ers|ed|ing)' | wc -l 42 $ git grep -E '[Mm]arshal(|s|er|ers|ed|ing)' | wc -l 1694 Make it consistently a single l, per earlier decisions. This means contributors won't be confused by misleading precedence, and it helps consistency. Change the spelling in one error value text in newRawAttributes of crypto/x509 package to be consistent. This change was generated with: perl -i -npe 's,([Mm]arshal)l(|s|er|ers|ed|ing),$1$2,' $(git grep -l -E '[Mm]arshall' | grep -v AUTHORS | grep -v CONTRIBUTORS) Updates #12431. Follows https://golang.org/cl/14150. Change-Id: I85d28a2d7692862ccb02d6a09f5d18538b6049a2 Reviewed-on: https://go-review.googlesource.com/33017 Run-TryBot: Minux Ma <minux@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-09-29html/template: check "type" attribute in <script>Nodir Turakulov
Currently any script tag is treated as a javascript container, although <script type="text/template"> must not be. Check "type" attribute of "script" tag. If it is present and it is not a JS MIME type, do not transition to elementScript state. Fixes #12149, where // inside text template was treated as regexp. Fixes #6701 Change-Id: I8fc9e504f7280bdd800f40383c061853665ac8a2 Reviewed-on: https://go-review.googlesource.com/14336 Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2015-05-19html/template: fix string iteration in replacement operationsDidier Spezia
In css, js, and html, the replacement operations are implemented by iterating on strings (rune by rune). The for/range statement is used. The length of the rune is required and added to the index to properly slice the string. This is potentially wrong because there is a discrepancy between the result of utf8.RuneLen and the increment of the index (set by the for/range statement). For invalid strings, utf8.RuneLen('\ufffd') == 3, while the index is incremented only by 1 byte. htmlReplacer triggers a panic at slicing time for some invalid strings. Use a more robust iteration mechanism based on utf8.DecodeRuneInString, and make sure the same pattern is used for all similar functions in this package. Fixes #10799 Change-Id: Ibad3857b2819435d9fa564f06fc2ca8774102841 Reviewed-on: https://go-review.googlesource.com/10105 Reviewed-by: Rob Pike <r@golang.org>
2014-09-08build: move package sources from src/pkg to srcRuss Cox
Preparation was in CL 134570043. This CL contains only the effect of 'hg mv src/pkg/* src'. For more about the move, see golang.org/s/go14nopkg.
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 20:12:47 +0000