From 97c859f8da0c85c33d0f29ba5e11094d8e691e87 Mon Sep 17 00:00:00 2001 From: Michal Bohuslávek Date: Wed, 2 Sep 2015 19:05:22 +0200 Subject: encoding/xml: reject invalid comments Fixes #11112. Change-Id: I16e7363549a0dec8c61addfa14af0866c1fd7c40 Reviewed-on: https://go-review.googlesource.com/14173 Reviewed-by: Russ Cox --- src/encoding/xml/xml.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'src/encoding/xml/xml.go') diff --git a/src/encoding/xml/xml.go b/src/encoding/xml/xml.go index bd766a6934..bdd607cfa8 100644 --- a/src/encoding/xml/xml.go +++ b/src/encoding/xml/xml.go @@ -624,7 +624,12 @@ func (d *Decoder) rawToken() (Token, error) { return nil, d.err } d.buf.WriteByte(b) - if b0 == '-' && b1 == '-' && b == '>' { + if b0 == '-' && b1 == '-' { + if b != '>' { + d.err = d.syntaxError( + `invalid sequence "--" not allowed in comments`) + return nil, d.err + } break } b0, b1 = b1, b -- cgit v1.3-5-g9baa