From 6277656d69640da9166bbac2a132a3ddee61dcac Mon Sep 17 00:00:00 2001 From: Nigel Tao Date: Thu, 12 Apr 2012 09:35:43 +1000 Subject: [PATCH] html, exp/html: escape ' and " as ' and ", since IE8 and below do not support '. This makes package html consistent with package text/template's HTMLEscape function. Fixes #3489. R=rsc, mikesamuel, dsymonds CC=golang-dev https://golang.org/cl/5992071 --- src/pkg/exp/html/escape.go | 8 +++++--- src/pkg/exp/html/render_test.go | 2 +- src/pkg/exp/html/token_test.go | 11 ++++++----- src/pkg/html/escape.go | 8 +++++--- src/pkg/net/http/server.go | 6 ++++-- src/pkg/text/template/funcs.go | 2 +- 6 files changed, 22 insertions(+), 15 deletions(-) diff --git a/src/pkg/exp/html/escape.go b/src/pkg/exp/html/escape.go index 8f62a8c288..c177a66068 100644 --- a/src/pkg/exp/html/escape.go +++ b/src/pkg/exp/html/escape.go @@ -205,13 +205,15 @@ func escape(w writer, s string) error { case '&': esc = "&" case '\'': - esc = "'" + // "'" is shorter than "'" and apos was not in HTML until HTML5. + esc = "'" case '<': esc = "<" case '>': esc = ">" case '"': - esc = """ + // """ is shorter than """. + esc = """ default: panic("unrecognized escape character") } @@ -226,7 +228,7 @@ func escape(w writer, s string) error { } // EscapeString escapes special characters like "<" to become "<". It -// escapes only five such characters: amp, apos, lt, gt and quot. +// escapes only five such characters: <, >, &, ' and ". // UnescapeString(EscapeString(s)) == s always holds, but the converse isn't // always true. func EscapeString(s string) string { diff --git a/src/pkg/exp/html/render_test.go b/src/pkg/exp/html/render_test.go index 0584f35abd..a2e205275d 100644 --- a/src/pkg/exp/html/render_test.go +++ b/src/pkg/exp/html/render_test.go @@ -98,7 +98,7 @@ func TestRenderer(t *testing.T) { }, }, } - want := `0<1

` + + want := `0<1

` + `23&4

` + `5

6` b := new(bytes.Buffer) diff --git a/src/pkg/exp/html/token_test.go b/src/pkg/exp/html/token_test.go index 61d74006ea..4e6eca93c5 100644 --- a/src/pkg/exp/html/token_test.go +++ b/src/pkg/exp/html/token_test.go @@ -359,7 +359,7 @@ var tokenTests = []tokenTest{ { "tricky", "

te<&;xt

", - `

$$te<&;xt$$

`, + `

$$te<&;xt$$

`, }, // A nonexistent entity. Tokenizing and converting back to a string should // escape the "&" to become "&". @@ -421,7 +421,7 @@ var tokenTests = []tokenTest{ { "Double-quoted attribute value", ``, - ``, + ``, }, { "Attribute name characters", @@ -436,7 +436,7 @@ var tokenTests = []tokenTest{ { "Attributes with a solitary single quote", `

`, - `

`, + `

`, }, } @@ -545,10 +545,11 @@ func TestUnescapeEscape(t *testing.T) { `"<&>"`, `"<&>"`, `3&5==1 && 0<1, "0<1", a+acute=á`, + `The special characters are: <, >, &, ' and "`, } for _, s := range ss { - if s != UnescapeString(EscapeString(s)) { - t.Errorf("s != UnescapeString(EscapeString(s)), s=%q", s) + if got := UnescapeString(EscapeString(s)); got != s { + t.Errorf("got %q want %q", got, s) } } } diff --git a/src/pkg/html/escape.go b/src/pkg/html/escape.go index fee771a578..24cb7af852 100644 --- a/src/pkg/html/escape.go +++ b/src/pkg/html/escape.go @@ -210,13 +210,15 @@ func escape(w writer, s string) error { case '&': esc = "&" case '\'': - esc = "'" + // "'" is shorter than "'" and apos was not in HTML until HTML5. + esc = "'" case '<': esc = "<" case '>': esc = ">" case '"': - esc = """ + // """ is shorter than """. + esc = """ default: panic("unrecognized escape character") } @@ -231,7 +233,7 @@ func escape(w writer, s string) error { } // EscapeString escapes special characters like "<" to become "<". It -// escapes only five such characters: amp, apos, lt, gt and quot. +// escapes only five such characters: <, >, &, ' and ". // UnescapeString(EscapeString(s)) == s always holds, but the converse isn't // always true. func EscapeString(s string) string { diff --git a/src/pkg/net/http/server.go b/src/pkg/net/http/server.go index 228ac40196..924ffd3481 100644 --- a/src/pkg/net/http/server.go +++ b/src/pkg/net/http/server.go @@ -785,8 +785,10 @@ var htmlReplacer = strings.NewReplacer( "&", "&", "<", "<", ">", ">", - `"`, """, - "'", "'", + // """ is shorter than """. + `"`, """, + // "'" is shorter than "'" and apos was not in HTML until HTML5. + "'", "'", ) func htmlEscape(s string) string { diff --git a/src/pkg/text/template/funcs.go b/src/pkg/text/template/funcs.go index 525179cb49..8fbf0ef50a 100644 --- a/src/pkg/text/template/funcs.go +++ b/src/pkg/text/template/funcs.go @@ -246,7 +246,7 @@ func not(arg interface{}) (truth bool) { var ( htmlQuot = []byte(""") // shorter than """ - htmlApos = []byte("'") // shorter than "'" + htmlApos = []byte("'") // shorter than "'" and apos was not in HTML until HTML5 htmlAmp = []byte("&") htmlLt = []byte("<") htmlGt = []byte(">") -- 2.48.1