]> Cypherpunks repositories - gostls13.git/commit
exp/template/html: render templates unusable when escaping fails
authorMike Samuel <mikesamuel@gmail.com>
Thu, 15 Sep 2011 03:40:50 +0000 (20:40 -0700)
committerMike Samuel <mikesamuel@gmail.com>
Thu, 15 Sep 2011 03:40:50 +0000 (20:40 -0700)
commit3eb41fbeb6157c043a1c848fe670dd1fd762e177
tree9ebcac5cb0f865ca3d5307cb42162b8f44c98af8
parent5c3032598344555e117f863f9c4227f5659ce3ab
exp/template/html: render templates unusable when escaping fails

This moots a caveat in the proposed package documentation by
rendering useless any template that could not be escaped.

From https://golang.org/cl/4969078/
> If EscapeSet returns an error, do not Execute the set; it is not
> safe against injection.
r: [but isn't the returned set nil? i guess you don't overwrite the
r: original if there's a problem, but i think you're in your rights to
r: do so]

R=r
CC=golang-dev
https://golang.org/cl/5020043
src/pkg/exp/template/html/doc.go
src/pkg/exp/template/html/escape.go
src/pkg/exp/template/html/escape_test.go