1
0
mirror of https://github.com/golang/go synced 2024-10-05 05:11:25 -06:00
go/src/html
Didier Spezia ca91de7ca0 html/template: prevent panic while escaping pipelines
AFAIK, the documentation does not explicitly state whether
variables can store a callable entity or not. I believe the
current implementation in text/template assumes they cannot
though. The call builtin function is supposed to be used for
this purpose.

Template "{{0|$}}" should generate an error at runtime,
instead of a panic.

Similarly, template "{{0|(nil)}}" should not generate
a panic.

This CL aborts the sanitization process for a given pipeline
when no identifier can be derived from the selected node.
It happens with malformed pipelines.

We now have the following errors:

{{ 0 | $ }}
template: foo:1:10: executing "foo" at <$>: can't give argument to non-function $

{{ 0 | (nil) }}
template: foo:1:11: executing "foo" at <nil>: nil is not a command

Fixes #11118
Fixes #11356

Change-Id: Idae52f806849f4c9ab7aca1b4bb4b59a74723d0e
Reviewed-on: https://go-review.googlesource.com/10823
Reviewed-by: Rob Pike <r@golang.org>
2015-06-27 22:44:33 +00:00
..
template html/template: prevent panic while escaping pipelines 2015-06-27 22:44:33 +00:00
entity_test.go build: move package sources from src/pkg to src 2014-09-08 00:08:51 -04:00
entity.go build: move package sources from src/pkg to src 2014-09-08 00:08:51 -04:00
escape_test.go html: simplify and optimize escape/unescape 2015-05-08 19:10:10 +00:00
escape.go html: simplify and optimize escape/unescape 2015-05-08 19:10:10 +00:00
example_test.go html: add examples to the functions 2015-06-19 05:15:22 +00:00