qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-19 17:14:44 -07:00
Code Releases Activity

html/template: Added more explicit wording about examples and documentation.

Browse Source 
R=golang-dev, r, r
CC=golang-dev
https://golang.org/cl/5654062
This commit is contained in:
Bjorn Tipling 2012-02-12 12:18:00 +11:00 committed by Rob Pike
parent 46dc76f5da
commit 5b663057b7
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/pkg/html/template/doc.go
View File

@ -3,15 +3,19 @@
// license that can be found in the LICENSE file. // license that can be found in the LICENSE file.
/* /*
Package template (html/template) is a specialization of package text/template Package template (html/template) implements data-driven templates for
that automates the construction of HTML output that is safe against code generating HTML output safe against code injection. It provides the
injection. same interface as package text/template and should be used instead of
text/template whenever the output is HTML.
The documentation here focuses on the security features of the package.
For information about how to program the templates themselves, see the
documentation for text/template.
Introduction Introduction
This package wraps package template so you can use the standard template API This package wraps package text/template so you can share its template API
to parse and execute templates. to parse and execute HTML templates safely.
set, err := new(template.Set).Parse(...) set, err := new(template.Set).Parse(...)
// Error checking elided // Error checking elided
@ -25,7 +29,8 @@ can be safely embedded in an HTML document. The escaping is contextual, so
actions can appear within JavaScript, CSS, and URI contexts. actions can appear within JavaScript, CSS, and URI contexts.
The security model used by this package assumes that template authors are The security model used by this package assumes that template authors are
trusted, while Execute's data parameter is not. More details are provided below. trusted, while text/template Execute's data parameter is not. More details are
provided below.
Example Example
@ -38,7 +43,7 @@ produces
Hello, <script>alert('you have been pwned')</script>! Hello, <script>alert('you have been pwned')</script>!
but with contextual autoescaping, but the contextual autoescaping in html/template
import "html/template" import "html/template"
... ...