]> Cypherpunks repositories - gostls13.git/commitdiff
projects / gostls13.git / commitdiff
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 9aae648)
exp/template/html: don't normalize '<' in doctypes.
authorMike Samuel <mikesamuel@gmail.com>
Wed, 28 Sep 2011 20:32:56 +0000 (13:32 -0700)
committerMike Samuel <mikesamuel@gmail.com>
Wed, 28 Sep 2011 20:32:56 +0000 (13:32 -0700)
The normalization that prevents element name and comment injection in
  <{{.}}
by converting it to
  &lt;{{.}}
breaks
  <!DOCTYPE html>

Instead of splitting states to have a start of document state and a text
state, I whitelist <!DOCTYPE.

R=nigeltao
CC=golang-dev
https://golang.org/cl/5131051

src/pkg/exp/template/html/escape.go patch | blob | history
src/pkg/exp/template/html/escape_test.go patch | blob | history

diff --git a/src/pkg/exp/template/html/escape.go b/src/pkg/exp/template/html/escape.go
index bb286c88445d8eef9815920f79f3fec865fd42f3..c43a16425fd9a6849cfb80f26daf727f9e95f616 100644 (file)
--- a/src/pkg/exp/template/html/escape.go
+++ b/src/pkg/exp/template/html/escape.go
@@ -549,6 +549,8 @@ var delimEnds = [...]string{
        delimSpaceOrTagEnd: " \t\n\f\r>",
 }
 
+var doctypeBytes = []byte("<!DOCTYPE")
+
 // escapeText escapes a text template node.
 func (e *escaper) escapeText(c context, n *parse.TextNode) context {
        s, written, i, b := n.Text, 0, 0, new(bytes.Buffer)
@@ -566,7 +568,7 @@ func (e *escaper) escapeText(c context, n *parse.TextNode) context {
                                }
                        }
                        for j := i; j < end; j++ {
-                               if s[j] == '<' {
+                               if s[j] == '<' && !bytes.HasPrefix(s[j:], doctypeBytes) {
                                        b.Write(s[written:j])
                                        b.WriteString("&lt;")
                                        written = j + 1
diff --git a/src/pkg/exp/template/html/escape_test.go b/src/pkg/exp/template/html/escape_test.go
index c46445916571d4765139ebd648b41456a65d45b1..0ca3c56619133a4d710093d51a4eb571d2ca988f 100644 (file)
--- a/src/pkg/exp/template/html/escape_test.go
+++ b/src/pkg/exp/template/html/escape_test.go
@@ -420,6 +420,16 @@ func TestEscape(t *testing.T) {
                        "a<<!-- --><!-- -->b",
                        "a&lt;b",
                },
+               {
+                       "HTML doctype not normalized",
+                       "<!DOCTYPE html>Hello, World!",
+                       "<!DOCTYPE html>Hello, World!",
+               },
+               {
+                       "No doctype injection",
+                       `<!{{"DOCTYPE"}}`,
+                       "&lt;!DOCTYPE",
+               },
                {
                        "Split HTML comment",
                        "<b>Hello, <!-- name of {{if .T}}city -->{{.C}}{{else}}world -->{{.W}}{{end}}</b>",
Go GOST TLS 1.3