qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-18 08:14:41 -07:00
Code Releases Activity

html/template: fix pipeline sanitization

Browse Source 
Pipelines are altered by inserting sanitizers if they are not
already present. The code makes the assumption that the first
operands of each commands are function identifiers.

This is wrong, since they can also be methods. It results in
a panic with templates such as {{1|print 2|.f 3}}

Adds an extra type assertion to make sure only identifiers
are compared with sanitizers.

Fixes #10673

Change-Id: I3eb820982675231dbfa970f197abc5ef335ce86b
Reviewed-on: https://go-review.googlesource.com/9801
Reviewed-by: Rob Pike <r@golang.org>
This commit is contained in:
Didier Spezia 2015-05-06 22:14:32 +00:00 committed by Rob Pike
parent 3a3773c8cb
commit 91d989eb6d
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/html/template/escape.go
View File

@ -297,9 +297,9 @@ var redundantFuncs = map[string]map[string]bool{
// unless it is redundant with the last command.
func appendCmd(cmds []*parse.CommandNode, cmd *parse.CommandNode) []*parse.CommandNode {
if n := len(cmds); n != 0 {
last, ok := cmds[n-1].Args[0].(*parse.IdentifierNode)
next, _ := cmd.Args[0].(*parse.IdentifierNode)
if ok && redundantFuncs[last.Ident][next.Ident] {
last, okLast := cmds[n-1].Args[0].(*parse.IdentifierNode)
next, okNext := cmd.Args[0].(*parse.IdentifierNode)
if okLast && okNext && redundantFuncs[last.Ident][next.Ident] {
return cmds
}
}

10
src/html/template/escape_test.go
View File

@ -1547,6 +1547,16 @@ func TestEnsurePipelineContains(t *testing.T) {
"($).X | urlquery | html | print",
[]string{"urlquery", "html"},
},
{
"{{.X | print 2 | .f 3}}",
".X | print 2 | .f 3 | urlquery | html",
[]string{"urlquery", "html"},
},
{
"{{.X | html | print 2 | .f 3}}",
".X | urlquery | html | print 2 | .f 3",
[]string{"urlquery", "html"},
},
}
for i, test := range tests {
tmpl := template.Must(template.New("test").Parse(test.input))