cybercyst/go
1
0
Fork 0
mirror of https://github.com/golang/go.git synced 2025-05-20 06:43:26 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

html/template: remove noescape support

Browse Source 
This was never documented or properly implemented.

Fixes #3528.

R=mikesamuel, rsc
CC=golang-dev
https://golang.org/cl/7142048
This commit is contained in:
Andrew Gerrand 2013-01-18 10:30:12 +11:00
parent 5bd5ed2b57
commit c022943449
3 changed files with 8 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
doc/go1.1.html
View File

@ -116,6 +116,13 @@ calls the debug/elf functions Symbols or ImportedSymbols may need to be
adjusted to account for the additional symbol and the change in symbol offsets. adjusted to account for the additional symbol and the change in symbol offsets.
</p> </p>
<h3 id="html/template">html/template</h3>
<p>
Templates using the undocumented and only partially implemented
"noescape" feature will break: that feature was removed.
</p>
<h3 id="net">net</h3> <h3 id="net">net</h3>
<p> <p>

5
src/pkg/html/template/escape.go
View File

@ -220,10 +220,7 @@ func ensurePipelineContains(p *parse.PipeNode, s []string) {
idents := p.Cmds idents := p.Cmds
for i := n - 1; i >= 0; i-- { for i := n - 1; i >= 0; i-- {
if cmd := p.Cmds[i]; len(cmd.Args) != 0 { if cmd := p.Cmds[i]; len(cmd.Args) != 0 {
if id, ok := cmd.Args[0].(*parse.IdentifierNode); ok { if _, ok := cmd.Args[0].(*parse.IdentifierNode); ok {
if id.Ident == "noescape" {
return
}
continue continue
} }
} }

11
src/pkg/html/template/escape_test.go
View File

@ -550,11 +550,6 @@ func TestEscape(t *testing.T) {
"<textarea>{{range .A}}{{.}}{{end}}</textarea>", "<textarea>{{range .A}}{{.}}{{end}}</textarea>",
"<textarea>&lt;a&gt;&lt;b&gt;</textarea>", "<textarea>&lt;a&gt;&lt;b&gt;</textarea>",
}, },
{
"auditable exemption from escaping",
"{{range .A}}{{. | noescape}}{{end}}",
"<a><b>",
},
{ {
"No tag injection", "No tag injection",
`{{"10$"}}<{{"script src,evil.org/pwnd.js"}}...`, `{{"10$"}}<{{"script src,evil.org/pwnd.js"}}...`,
@ -659,12 +654,6 @@ func TestEscape(t *testing.T) {
for _, test := range tests { for _, test := range tests {
tmpl := New(test.name) tmpl := New(test.name)
// TODO: Move noescape into template/func.go
tmpl.Funcs(FuncMap{
"noescape": func(a ...interface{}) string {
return fmt.Sprint(a...)
},
})
tmpl = Must(tmpl.Parse(test.input)) tmpl = Must(tmpl.Parse(test.input))
b := new(bytes.Buffer) b := new(bytes.Buffer)
if err := tmpl.Execute(b, data); err != nil { if err := tmpl.Execute(b, data); err != nil {