From 994692847a2cd3efd319f0cb61a07c0012c8a4ff Mon Sep 17 00:00:00 2001 From: Roland Shoemaker Date: Fri, 9 Jan 2026 11:12:01 -0800 Subject: [release-branch.go1.26] html/template: properly escape URLs in meta content attributes The meta tag can include a content attribute that contains URLs, which we currently don't escape if they are inserted via a template action. This can plausibly lead to XSS vulnerabilities if untrusted data is inserted there, the http-equiv attribute is set to "refresh", and the content attribute contains an action like `url={{.}}`. Track whether we are inside of a meta element, if we are inside of a content attribute, _and_ if the content attribute contains "url=". If all of those are true, then we will apply the same URL escaping that we use elsewhere. Also add a new GODEBUG, htmlmetacontenturlescape, to allow disabling this escaping for cases where this behavior is considered safe. The behavior can be disabled by setting htmlmetacontenturlescape=0. Updates #77954 Fixes #77972 Fixes CVE-2026-27142 Change-Id: I9bbca263be9894688e6ef1e9a8f8d2f4304f5873 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3360 Reviewed-by: Neal Patel Reviewed-by: Nicholas Husin Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3643 Reviewed-by: Damien Neil Reviewed-on: https://go-review.googlesource.com/c/go/+/752081 Auto-Submit: Gopher Robot Reviewed-by: Cherry Mui TryBot-Bypass: Gopher Robot Reviewed-by: Dmitri Shuralyov --- src/html/template/context.go | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src/html/template/context.go') diff --git a/src/html/template/context.go b/src/html/template/context.go index b78f0f7325..8b3af2feab 100644 --- a/src/html/template/context.go +++ b/src/html/template/context.go @@ -156,6 +156,10 @@ const ( // stateError is an infectious error state outside any valid // HTML/CSS/JS construct. stateError + // stateMetaContent occurs inside a HTML meta element content attribute. + stateMetaContent + // stateMetaContentURL occurs inside a "url=" tag in a HTML meta element content attribute. + stateMetaContentURL // stateDead marks unreachable code after a {{break}} or {{continue}}. stateDead ) @@ -267,6 +271,8 @@ const ( elementTextarea // elementTitle corresponds to the RCDATA element. elementTitle + // elementMeta corresponds to the HTML <meta> element. + elementMeta ) //go:generate stringer -type attr @@ -288,4 +294,6 @@ const ( attrURL // attrSrcset corresponds to a srcset attribute. attrSrcset + // attrMetaContent corresponds to the content attribute in meta HTML element. + attrMetaContent ) -- cgit v1.3