qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-22 03:24:41 -07:00
Code Releases Activity

html: update jstmpllitinterp doc

Browse Source 
We no longer do anything with this GODEBUG.

Fixes #66217

Change-Id: I998797b6a573013f5b9c8ded835acae572327d18
Reviewed-on: https://go-review.googlesource.com/c/go/+/584117
Reviewed-by: Cherry Mui <cherryyz@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Roland Shoemaker <roland@golang.org>
This commit is contained in:
Roland Shoemaker 2024-05-08 09:17:05 -07:00 committed by Gopher Robot
parent aeb2c2a896
commit 0ec709f180
2 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
doc/godebug.md
View File

@ -193,6 +193,10 @@ Go 1.23 changed the behavior of
serial numbers that are longer than 20 octets. This change can be reverted with
the the [`x509seriallength` setting](/pkg/crypto/x509/#ParseCertificate).
Go 1.23 re-enabled support in html/template for ECMAScript 6 template literals by default.
The [`jstmpllitinterp` setting](/pkg/html/template#hdr-Security_Model) no longer has
any effect.
### Go 1.22
Go 1.22 adds a configurable limit to control the maximum acceptable RSA key size

10
src/html/template/doc.go
View File

@ -232,11 +232,9 @@ Least Surprise Property:
knows that contextual autoescaping happens should be able to look at a {{.}}
and correctly infer what sanitization happens."
As a consequence of the Least Surprise Property, template actions within an
ECMAScript 6 template literal are disabled by default.
Handling string interpolation within these literals is rather complex resulting
in no clear safe way to support it.
To re-enable template actions within ECMAScript 6 template literals, use the
GODEBUG=jstmpllitinterp=1 environment variable.
Previously, ECMAScript 6 template literal were disabled by default, and could be
enabled with the GODEBUG=jstmpllitinterp=1 environment variable. Template
literals are now supported by default, and setting jstmpllitinterp has no
effect.
*/
package template