]> Cypherpunks repositories - gostls13.git/commit
text/template: limit expression parenthesis nesting
authorVille Vesilehto <ville@vesilehto.fi>
Wed, 14 May 2025 18:16:54 +0000 (18:16 +0000)
committerGopher Robot <gobot@golang.org>
Sat, 17 May 2025 10:27:48 +0000 (03:27 -0700)
commit42f9ee904caf6681ee32e7b048f15ab7cddf3eb3
treedba6ef2dd28748581ba950cea159801160154797
parent6425749695130f2032ac9cfdf5407b6a322534db
text/template: limit expression parenthesis nesting

Deeply nested parenthesized expressions could cause a stack
overflow during parsing. This change introduces a depth limit
(maxStackDepth) tracked in Tree.stackDepth to prevent this.

Additionally, this commit clarifies the security model in
the package documentation, noting that template authors
are trusted as text/template does not auto-escape.

Fixes #71201

Change-Id: Iab2c2ea6c193ceb44bb2bc7554f3fccf99a9542f
GitHub-Last-Rev: f4ebd1719ff966ae3c6516e3fb935dfea2f5362e
GitHub-Pull-Request: golang/go#73670
Reviewed-on: https://go-review.googlesource.com/c/go/+/671755
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Auto-Submit: Sean Liao <sean@liao.dev>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Rob Pike <r@golang.org>
src/text/template/doc.go
src/text/template/parse/parse.go
src/text/template/parse/parse_test.go