tag is missing a '>'. - EscapeSet cannot tell whether {{.}} is meant to be an HTML class or the - content of a broken
element and complains because the second iteration - would produce something like - -
alert("\{{.X}}")
-Discussion:
- EscapeSet does not support actions following a backslash.
- This is usually an error and there are better solutions; for
- our example
-
- should work, and if {{.X}} is a partial escape sequence such as
- "xA0", give it the type ContentTypeJSStr and include the whole
- sequence, as in
- {`\xA0`, ContentTypeJSStr}
-
-Error: "unfinished JS regexp charset in ..."
-Example:
-
-Discussion:
- EscapeSet does not support interpolation into regular expression literal
- character sets.
-
-Error: "ZgotmplZ"
-Example:
-
- where {{.X}} evaluates to `javascript:...`
-Discussion:
- "ZgotmplZ" is a special value that indicates that unsafe content reached
- a CSS or URL context at runtime. The output of the example will be
-
- If the data can be trusted, giving the string type XXX will exempt
- it from filtering.
A fuller picture
@@ -249,8 +79,6 @@ details necessary to understand escaping contexts and error messages. Most users
will not need to understand these details.
-
-
Contexts
Assuming {{.}} is `O'Reilly: How are you?`, the table below shows
diff --git a/src/pkg/exp/template/html/error.go b/src/pkg/exp/template/html/error.go
new file mode 100644
index 00000000000..5fa23574335
--- /dev/null
+++ b/src/pkg/exp/template/html/error.go
@@ -0,0 +1,194 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package html
+
+import (
+ "fmt"
+)
+
+// Error describes a problem encountered during template Escaping.
+type Error struct {
+ // ErrorCode describes the kind of error.
+ ErrorCode ErrorCode
+ // Name is the name of the template in which the error was encountered.
+ Name string
+ // Line is the line number of the error in the template source or 0.
+ Line int
+ // Description is a human-readable description of the problem.
+ Description string
+}
+
+// ErrorCode is a code for a kind of error.
+type ErrorCode int
+
+// We define codes for each error that manifests while escaping templates, but
+// escaped templates may also fail at runtime.
+//
+// Output: "ZgotmplZ"
+// Example:
+//
+// where {{.X}} evaluates to `javascript:...`
+// Discussion:
+// "ZgotmplZ" is a special value that indicates that unsafe content reached a
+// CSS or URL context at runtime. The output of the example will be
+//
+// If the data comes from a trusted source, use content types to exempt it
+// from filtering: URL(`javascript:...`).
+const (
+ // OK indicates the lack of an error.
+ OK ErrorCode = iota
+
+ // ErrorAmbigContext: "... appears in an ambiguous URL context"
+ // Example:
+ //
+ // Discussion:
+ // {{.X}} is in an ambiguous URL context since, depending on {{.C}},
+ // it may be either a URL suffix or a query parameter.
+ // Moving {{.X}} into the condition removes the ambiguity:
+ //
+ ErrAmbigContext
+
+ // TODO: document
+ ErrBadHTML
+
+ // ErrBranchEnd: "{{if}} branches end in different contexts"
+ // Example:
+ // {{if .C}}{{template "helper"}} {{end}}
+ // {{define "helper"}} document.write(' tag is missing a '>'.
+ // EscapeSet cannot tell whether {{.}} is meant to be an HTML class or
+ // the content of a broken element and complains because the
+ // second iteration would produce something like
+ //
+ //