mirror of
https://github.com/golang/go
synced 2024-11-13 17:30:24 -07:00
exp/template/html: Reworked escapeText to recognize attr boundaries.
The following testcases now pass: `<a href=x` tests that we do not error on partial unquoted attrs. `<a href=x ` tests that spaces do end unquoted attrs on spaces. `<a href=''` tests that we recognize the end of single quoted attrs. `<a href=""` tests that we recognize the end of double quoted attrs. R=golang-dev, nigeltao CC=golang-dev https://golang.org/cl/4932051
This commit is contained in:
Mike Samuel
Nigel Tao
parent
15580526de
commit
42a56d3e81
@ -23,6 +23,9 @@ func Escape(t *template.Template) (*template.Template, os.Error) {
|
||||
if c.errStr != "" {
|
||||
return nil, fmt.Errorf("%s:%d: %s", t.Name(), c.errLine, c.errStr)
|
||||
}
|
||||
if c.state != stateText {
|
||||
return nil, fmt.Errorf("%s ends in a non-text context: %v", t.Name(), c)
|
||||
}
|
||||
return t, nil
|
||||
}
|
||||
|
||||
@ -38,7 +41,7 @@ func escape(c context, n parse.Node) context {
|
||||
case *parse.RangeNode:
|
||||
return escapeBranch(c, &n.BranchNode, "range")
|
||||
case *parse.TextNode:
|
||||
return escapeText(c, n)
|
||||
return escapeText(c, n.Text)
|
||||
case *parse.WithNode:
|
||||
return escapeBranch(c, &n.BranchNode, "with")
|
||||
}
|
||||
@ -91,11 +94,19 @@ func join(a, b context, line int, nodeName string) context {
|
||||
// escapeBranch escapes a branch template node: "if", "range" and "with".
|
||||
func escapeBranch(c context, n *parse.BranchNode, nodeName string) context {
|
||||
c0 := escapeList(c, n.List)
|
||||
if nodeName == "range" {
|
||||
if nodeName == "range" && c0.state != stateError {
|
||||
// The "true" branch of a "range" node can execute multiple times.
|
||||
// We check that executing n.List once results in the same context
|
||||
// as executing n.List twice.
|
||||
c0 = join(c0, escapeList(c0, n.List), n.Line, nodeName)
|
||||
if c0.state == stateError {
|
||||
// Make clear that this is a problem on loop re-entry
|
||||
// since developers tend to overlook that branch when
|
||||
// debugging templates.
|
||||
c0.errLine = n.Line
|
||||
c0.errStr = "on range loop re-entry: " + c0.errStr
|
||||
return c0
|
||||
}
|
||||
}
|
||||
c1 := escapeList(c, n.ElseList)
|
||||
return join(c0, c1, n.Line, nodeName)
|
||||
@ -112,10 +123,40 @@ func escapeList(c context, n *parse.ListNode) context {
|
||||
return c
|
||||
}
|
||||
|
||||
// delimEnds maps each delim to a string of characters that terminate it.
|
||||
var delimEnds = [...]string{
|
||||
delimDoubleQuote: `"`,
|
||||
delimSingleQuote: "'",
|
||||
// Determined empirically by running the below in various browsers.
|
||||
// var div = document.createElement("DIV");
|
||||
// for (var i = 0; i < 0x10000; ++i) {
|
||||
// div.innerHTML = "<span title=x" + String.fromCharCode(i) + "-bar>";
|
||||
// if (div.getElementsByTagName("SPAN")[0].title.indexOf("bar") < 0)
|
||||
// document.write("<p>U+" + i.toString(16));
|
||||
// }
|
||||
delimSpaceOrTagEnd: " \t\n\f\r>",
|
||||
}
|
||||
|
||||
// escapeText escapes a text template node.
|
||||
func escapeText(c context, n *parse.TextNode) context {
|
||||
for s := n.Text; len(s) > 0; {
|
||||
c, s = transitionFunc[c.state](c, s)
|
||||
func escapeText(c context, s []byte) context {
|
||||
for len(s) > 0 {
|
||||
if c.delim == delimNone {
|
||||
c, s = transitionFunc[c.state](c, s)
|
||||
continue
|
||||
}
|
||||
|
||||
i := bytes.IndexAny(s, delimEnds[c.delim])
|
||||
if i == -1 {
|
||||
// Remain inside the attribute.
|
||||
// TODO: Recurse to take into account grammars for
|
||||
// JS, CSS, URIs embedded in attrs once implemented.
|
||||
return c
|
||||
}
|
||||
if c.delim != delimSpaceOrTagEnd {
|
||||
// Consume any quote.
|
||||
i++
|
||||
}
|
||||
c, s = context{state: stateTag}, s[i:]
|
||||
}
|
||||
return c
|
||||
}
|
||||
@ -157,15 +198,15 @@ func tText(c context, s []byte) (context, []byte) {
|
||||
|
||||
// tTag is the context transition function for the tag state.
|
||||
func tTag(c context, s []byte) (context, []byte) {
|
||||
// Skip to the end tag, if there is one.
|
||||
i := bytes.IndexByte(s, '>')
|
||||
if i != -1 {
|
||||
return context{state: stateText}, s[i+1:]
|
||||
// Find the attribute name.
|
||||
attrStart := eatWhiteSpace(s, 0)
|
||||
i, err := eatAttrName(s, attrStart)
|
||||
if err != nil {
|
||||
return context{
|
||||
state: stateError,
|
||||
errStr: err.String(),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// Otherwise, find the attribute name.
|
||||
i = eatWhiteSpace(s, 0)
|
||||
attrStart, i := i, eatAttrName(s, i)
|
||||
if i == len(s) {
|
||||
return context{state: stateTag}, nil
|
||||
}
|
||||
@ -174,37 +215,44 @@ func tTag(c context, s []byte) (context, []byte) {
|
||||
state = stateURL
|
||||
}
|
||||
|
||||
// Consume the "=".
|
||||
// Look for the start of the value.
|
||||
i = eatWhiteSpace(s, i)
|
||||
if i == len(s) || s[i] != '=' {
|
||||
if i == len(s) {
|
||||
return context{state: stateTag}, s[i:]
|
||||
}
|
||||
if s[i] == '>' {
|
||||
return context{state: stateText}, s[i+1:]
|
||||
} else if s[i] != '=' {
|
||||
// Possible due to a valueless attribute or '/' in "<input />".
|
||||
return context{state: stateTag}, s[i:]
|
||||
}
|
||||
// Consume the "=".
|
||||
i = eatWhiteSpace(s, i+1)
|
||||
|
||||
// Find the delimiter.
|
||||
if i == len(s) {
|
||||
return context{state: state, delim: delimSpaceOrTagEnd}, nil
|
||||
}
|
||||
switch s[i] {
|
||||
case '\'':
|
||||
return context{state: state, delim: delimSingleQuote}, s[i+1:]
|
||||
case '"':
|
||||
return context{state: state, delim: delimDoubleQuote}, s[i+1:]
|
||||
// Find the attribute delimiter.
|
||||
if i < len(s) {
|
||||
switch s[i] {
|
||||
case '\'':
|
||||
return context{state: state, delim: delimSingleQuote}, s[i+1:]
|
||||
case '"':
|
||||
return context{state: state, delim: delimDoubleQuote}, s[i+1:]
|
||||
}
|
||||
}
|
||||
|
||||
// TODO: This shouldn't be an error: `<a b=1 c={{.X}}` should be valid.
|
||||
return context{state: stateError}, nil
|
||||
return context{state: state, delim: delimSpaceOrTagEnd}, s[i:]
|
||||
}
|
||||
|
||||
// tAttr is the context transition function for the attribute state.
|
||||
func tAttr(c context, s []byte) (context, []byte) {
|
||||
// TODO: look for the delimiter.
|
||||
return c, nil
|
||||
}
|
||||
|
||||
// tURL is the context transition function for the URL state.
|
||||
func tURL(c context, s []byte) (context, []byte) {
|
||||
// TODO: look for the delimiter.
|
||||
// TODO: Look for query and fragment boundaries within a URL so we
|
||||
// can %-encode actions in the query and fragment parts, HTML escape
|
||||
// actions elsewhere, and filter any actions at the start that might
|
||||
// inject a dangerous protocol such as "javascript:".
|
||||
return c, nil
|
||||
}
|
||||
|
||||
@ -214,16 +262,24 @@ func tError(c context, s []byte) (context, []byte) {
|
||||
}
|
||||
|
||||
// eatAttrName returns the largest j such that s[i:j] is an attribute name.
|
||||
func eatAttrName(s []byte, i int) int {
|
||||
// It returns an error if s[i:] does not look like it begins with an
|
||||
// attribute name, such as encountering a quote mark without a preceding
|
||||
// equals sign.
|
||||
func eatAttrName(s []byte, i int) (int, os.Error) {
|
||||
for j := i; j < len(s); j++ {
|
||||
switch s[j] {
|
||||
case ' ', '\n', '\r', '\t', '=':
|
||||
return j
|
||||
case ' ', '\t', '\n', '\f', '\r', '=', '>':
|
||||
return j, nil
|
||||
case '\'', '"', '<':
|
||||
// These result in a parse warning in HTML5 and are
|
||||
// indicative of serious problems if seen in an attr
|
||||
// name in a template.
|
||||
return 0, fmt.Errorf("%q in attribute name: %.32q", s[j:j+1], s)
|
||||
default:
|
||||
// No-op.
|
||||
}
|
||||
}
|
||||
return len(s)
|
||||
return len(s), nil
|
||||
}
|
||||
|
||||
// eatTagName returns the largest j such that s[i:j] is a tag name.
|
||||
@ -248,7 +304,7 @@ func eatTagName(s []byte, i int) int {
|
||||
func eatWhiteSpace(s []byte, i int) int {
|
||||
for j := i; j < len(s); j++ {
|
||||
switch s[j] {
|
||||
case ' ', '\n', '\r', '\t':
|
||||
case ' ', '\t', '\n', '\f', '\r':
|
||||
// No-op.
|
||||
default:
|
||||
return j
|
||||
|
||||
@ -8,7 +8,6 @@ import (
|
||||
"bytes"
|
||||
"strings"
|
||||
"template"
|
||||
"template/parse"
|
||||
"testing"
|
||||
)
|
||||
|
||||
@ -87,6 +86,11 @@ func TestEscape(t *testing.T) {
|
||||
`<a href="{{"'a<b'"}}">`,
|
||||
`<a href="'a%3Cb'">`,
|
||||
},
|
||||
{
|
||||
"multipleAttrs",
|
||||
"<a b=1 c={{.H}}>",
|
||||
"<a b=1 c=<Hello>>",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range testCases {
|
||||
@ -147,15 +151,11 @@ func TestErrors(t *testing.T) {
|
||||
"{{if .Cond}}\n{{else}}\n<a{{end}}",
|
||||
"z:1: {{if}} branches",
|
||||
},
|
||||
/*
|
||||
TODO: Should the error really be non-empty? Both branches close the tag...
|
||||
|
||||
{
|
||||
// Missing quote in the else branch.
|
||||
{
|
||||
`{{if .Cond}}<a href="foo">{{else}}<a href="bar>{{end}}`,
|
||||
"z:1: {{if}} branches",
|
||||
},
|
||||
*/
|
||||
`{{if .Cond}}<a href="foo">{{else}}<a href="bar>{{end}}`,
|
||||
"z:1: {{if}} branches",
|
||||
},
|
||||
{
|
||||
// Different kind of attribute: href implies a URL.
|
||||
"<a {{if .Cond}}href='{{else}}title='{{end}}{{.X}}'>",
|
||||
@ -171,11 +171,15 @@ func TestErrors(t *testing.T) {
|
||||
},
|
||||
{
|
||||
"{{range .Items}}<a{{end}}",
|
||||
"z:1: {{range}} branches",
|
||||
`z:1: on range loop re-entry: "<" in attribute name: "<a"`,
|
||||
},
|
||||
{
|
||||
"\n{{range .Items}} x='<a{{end}}",
|
||||
"z:2: {{range}} branches",
|
||||
"z:2: on range loop re-entry: {{range}} branches",
|
||||
},
|
||||
{
|
||||
"<a b=1 c={{.H}}",
|
||||
"z ends in a non-text context: {stateAttr delimSpaceOrTagEnd",
|
||||
},
|
||||
}
|
||||
|
||||
@ -236,14 +240,38 @@ func TestEscapeText(t *testing.T) {
|
||||
`<a href=`,
|
||||
context{state: stateURL, delim: delimSpaceOrTagEnd},
|
||||
},
|
||||
{
|
||||
`<a href=x`,
|
||||
context{state: stateURL, delim: delimSpaceOrTagEnd},
|
||||
},
|
||||
{
|
||||
`<a href=x `,
|
||||
context{state: stateTag},
|
||||
},
|
||||
{
|
||||
`<a href=>`,
|
||||
context{state: stateText},
|
||||
},
|
||||
{
|
||||
`<a href=x>`,
|
||||
context{state: stateText},
|
||||
},
|
||||
{
|
||||
`<a href ='`,
|
||||
context{state: stateURL, delim: delimSingleQuote},
|
||||
},
|
||||
{
|
||||
`<a href=''`,
|
||||
context{state: stateTag},
|
||||
},
|
||||
{
|
||||
`<a href= "`,
|
||||
context{state: stateURL, delim: delimDoubleQuote},
|
||||
},
|
||||
{
|
||||
`<a href=""`,
|
||||
context{state: stateTag},
|
||||
},
|
||||
{
|
||||
`<a title="`,
|
||||
context{state: stateAttr, delim: delimDoubleQuote},
|
||||
@ -256,20 +284,29 @@ func TestEscapeText(t *testing.T) {
|
||||
`<a Href='/`,
|
||||
context{state: stateURL, delim: delimSingleQuote},
|
||||
},
|
||||
{
|
||||
`<a href='"`,
|
||||
context{state: stateURL, delim: delimSingleQuote},
|
||||
},
|
||||
{
|
||||
`<a href="'`,
|
||||
context{state: stateURL, delim: delimDoubleQuote},
|
||||
},
|
||||
{
|
||||
`<input checked type="checkbox"`,
|
||||
context{state: stateTag},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range testCases {
|
||||
n := &parse.TextNode{
|
||||
NodeType: parse.NodeText,
|
||||
Text: []byte(tc.input),
|
||||
}
|
||||
c := escapeText(context{}, n)
|
||||
b := []byte(tc.input)
|
||||
c := escapeText(context{}, b)
|
||||
if !tc.output.eq(c) {
|
||||
t.Errorf("input %q: want context %v got %v", tc.input, tc.output, c)
|
||||
continue
|
||||
}
|
||||
if tc.input != string(n.Text) {
|
||||
t.Errorf("input %q: text node was modified: want %q got %q", tc.input, tc.input, n.Text)
|
||||
if tc.input != string(b) {
|
||||
t.Errorf("input %q: text node was modified: want %q got %q", tc.input, tc.input, b)
|
||||
continue
|
||||
}
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user