qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-17 21:04:43 -07:00
Code Releases Activity
The Go programming language
32,162 Commits 58 Branches 402 Tags 522 MiB
Go 89.6%
Assembly 5.2%
HTML 4.8%
C 0.2%
Shell 0.1%
9ffd9339da
Go to file
Samuel Tan 9ffd9339da html/template: panic if predefined escapers are found in pipelines during rewriting 
Report an error if a predefined escaper (i.e. "html", "urlquery", or "js")
is found in a pipeline that will be rewritten by the contextual auto-escaper,
instead of trying to merge the escaper-inserted escaping directives
with these predefined escapers. This merging behavior is a source
of several security and correctness bugs (eee #19336, #19345, #19352,
and #19353.)

This merging logic was originally intended to ease migration of text/template
templates with user-defined escapers to html/template. Now that
migration is no longer an issue, this logic can be safely removed.

NOTE: this is a backward-incompatible change that fixes known security
bugs (see linked issues for more details). It will explicitly break users
that attempt to execute templates with pipelines containing predefined
escapers.

Fixes #19336, #19345, #19352, #19353

Change-Id: I46b0ca8a2809d179c13c0d4f42b63126ed1c3b49
Reviewed-on: https://go-review.googlesource.com/37880
Run-TryBot: Russ Cox <rsc@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
2017-04-10 15:08:47 +00:00
.github doc: improve issue template and contribution guidelines 2017-02-11 20:42:06 +00:00
api math/big: define Word as uint instead of uintptr 2017-02-21 19:31:40 +00:00
doc doc: document go1.8.1 2017-04-07 16:45:08 +00:00
lib/time *.bash: always use the same string equality operator 2017-03-14 21:46:31 +00:00
misc cmd/cgo: support floating point #define macros 2017-04-07 21:09:44 +00:00
src html/template: panic if predefined escapers are found in pipelines during rewriting 2017-04-10 15:08:47 +00:00
test runtime: improve output of panic(x) where x is numeric 2017-04-09 22:40:33 +00:00
.gitattributes
.gitignore cmd/dist: move cmd/go z files to cmd/go/internal/cfg 2017-02-03 20:30:52 +00:00
AUTHORS A+C: automated update 2016-12-21 03:22:22 +00:00
CONTRIBUTING.md doc: improve issue template and contribution guidelines 2017-02-11 20:42:06 +00:00
CONTRIBUTORS A+C: automated update 2016-12-21 03:22:22 +00:00
favicon.ico
LICENSE
PATENTS
README.md readme: add attribution for the Gopher image 2017-02-03 19:39:41 +00:00
robots.txt

README.md

The Go Programming Language

Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.

Gopher image Gopher image by Renee French, licensed under Creative Commons 3.0 Attributions license.

Our canonical Git repository is located at https://go.googlesource.com/go. There is a mirror of the repository at https://github.com/golang/go.

Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.

Download and Install

Binary Distributions

Official binary distributions are available at https://golang.org/dl/.

After downloading a binary release, visit https://golang.org/doc/install or load doc/install.html in your web browser for installation instructions.

Install From Source

If a binary distribution is not available for your combination of operating system and architecture, visit https://golang.org/doc/install/source or load doc/install-source.html in your web browser for source installation instructions.

Contributing

Go is the work of hundreds of contributors. We appreciate your help!

To contribute, please read the contribution guidelines: https://golang.org/doc/contribute.html

Note that the Go project does not use GitHub pull requests, and that we use the issue tracker for bug reports and proposals only. See https://golang.org/wiki/Questions for a list of places to ask questions about the Go language.