text/template: protect against explicit nil in field chains

An explicit nil in an expression like nil.Foo caused a panic
because the evaluator attempted to reflect on the nil.
A typeless nil like this cannot be used to do anything, so
just error out.

Fixes #9426

Change-Id: Icd2c9c7533dda742748bf161eced163991a12f54
Reviewed-on: https://go-review.googlesource.com/7643
Reviewed-by: David Symonds <dsymonds@golang.org>

diff --git a/src/text/template/exec.go b/src/text/template/exec.go
index b00e10c7e418460b4b6ba082e6e53172abdd14c9..faf31e3ede29171991fe1881040e49d3203ac7e1 100644 (file)
--- a/src/text/template/exec.go
+++ b/src/text/template/exec.go
@@ -418,11 +418,14 @@ func (s *state) evalFieldNode(dot reflect.Value, field *parse.FieldNode, args []
 
 func (s *state) evalChainNode(dot reflect.Value, chain *parse.ChainNode, args []parse.Node, final reflect.Value) reflect.Value {
        s.at(chain)
-       // (pipe).Field1.Field2 has pipe as .Node, fields as .Field. Eval the pipeline, then the fields.
-       pipe := s.evalArg(dot, nil, chain.Node)
        if len(chain.Field) == 0 {
                s.errorf("internal error: no fields in evalChainNode")
        }
+       if chain.Node.Type() == parse.NodeNil {
+               s.errorf("indirection through explicit nil in %s", chain)
+       }
+       // (pipe).Field1.Field2 has pipe as .Node, fields as .Field. Eval the pipeline, then the fields.
+       pipe := s.evalArg(dot, nil, chain.Node)
        return s.evalFieldChain(dot, pipe, chain, chain.Field, args, final)
 }
 

diff --git a/src/text/template/exec_test.go b/src/text/template/exec_test.go
index 69c213ed24503b59487fed5efc03d00f484d063d..b1f778797bae9bdcdd887defa100258d7a7a71a3 100644 (file)
--- a/src/text/template/exec_test.go
+++ b/src/text/template/exec_test.go
@@ -527,6 +527,8 @@ var execTests = []execTest{
        {"bug12XE", "{{printf `%T` 0XEE}}", "int", T{}, true},
        // Chained nodes did not work as arguments. Issue 8473.
        {"bug13", "{{print (.Copy).I}}", "17", tVal, true},
+       // Didn't protect against explicit nil in field chains.
+       {"bug14", "{{nil.True}}", "", tVal, false},
 }
 
 func zeroArgs() string {