From 8b2d2847a82da6539c9a0cd6b0d1290be888f411 Mon Sep 17 00:00:00 2001
From: Robert Griesemer <gri@golang.org>
Date: Wed, 28 Oct 2009 12:52:52 -0700
Subject: [PATCH] html-escaping of fields that may be user-generated

R=rsc
http://go/go-review/1013019
---
 lib/godoc/godoc.html | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/lib/godoc/godoc.html b/lib/godoc/godoc.html
index df8ee882a06..1cae952e271 100644
--- a/lib/godoc/godoc.html
+++ b/lib/godoc/godoc.html
@@ -4,7 +4,7 @@
 <head>
 
   <meta http-equiv="content-type" content="text/html; charset=utf-8">
-  <title>{Title}</title>
+  <title>{Title|html}</title>
 
   <link rel="stylesheet" type="text/css" href="/doc/style.css">
   <script type="text/javascript" src="/doc/godocs.js"></script>
@@ -49,22 +49,23 @@
     <li class="blank">&nbsp;</li>
     <li class="navhead">Go code search</li>
     <form method="GET" action="/search" class="search">
-    <input name="q" value="{Query}" size="25" />
+    <input name="q" value="{Query|html}" size="25" />
     <input type="submit" value="Go" />
 
     <li class="blank">&nbsp;</li>
     <li class="navhead">Last update</li>
-	<li>{Timestamp}</li>
+	<li>{Timestamp|html}</li>
   </ul>
 </div>
 
 <div id="content">
-  <h1>{Title}</h1>
+  <h1>{Title|html}</h1>
 
   <!-- The Table of Contents is automatically inserted in this <div>.
        Do not delete this <div>. -->
   <div id="nav"></div>
 
+  <!-- Content is HTML-escaped elsewhere -->
   {Content}
 </div>
 
