]> Cypherpunks repositories - gostls13.git/commit
[release-branch.go1.13] encoding/json: revert Compact HTML escaping documentation
authorTom Thorogood <me+google@tomthorogood.co.uk>
Fri, 2 Aug 2019 07:53:44 +0000 (07:53 +0000)
committerDmitri Shuralyov <dmitshur@golang.org>
Mon, 2 Sep 2019 21:39:04 +0000 (21:39 +0000)
commit2e65ef623b36bd4070d0d4cc50f0bc3fc86c1c85
treea2bcdafa651c9ef1248276bf364d9a84f54184a9
parentd7b402a49a8ef5af911d7873bdbc5f61335f1d41
[release-branch.go1.13] encoding/json: revert Compact HTML escaping documentation

This partly reverts CL 173417 as it incorrectly documented that Compact
performed HTML escaping and the output was safe to embed inside HTML
<script> tags. This has never been true.

Although Compact does escape U+2028 and U+2029, it doesn't escape <, >
or &. Compact is thus only performing a subset of HTML escaping and it's
output is not safe to embed inside HTML <script> tags.

A more complete fix would be for Compact to either never perform any
HTML escaping, as it was prior to CL 10883045, or to actually perform
the same HTML escaping as HTMLEscape. Neither change is likely safe
enough for go1.13.

Fixes #34006
Updates #30357

Change-Id: I912f0fe9611097d988048b28228c4a5b985080ba
GitHub-Last-Rev: aebababc9233c5705785b225377e80096d4bb8c4
GitHub-Pull-Request: golang/go#33427
Reviewed-on: https://go-review.googlesource.com/c/go/+/188717
Reviewed-by: Daniel Martí <mvdan@mvdan.cc>
Run-TryBot: Daniel Martí <mvdan@mvdan.cc>
TryBot-Result: Gobot Gobot <gobot@golang.org>
(cherry picked from commit 79669dc705aa8fcddc8f9407c568e4317d619dfe)
Reviewed-on: https://go-review.googlesource.com/c/go/+/192747
Reviewed-by: Andrew Bonventre <andybons@golang.org>
Run-TryBot: Andrew Bonventre <andybons@golang.org>
src/encoding/json/indent.go