Samuel Tan 9ffd9339da html/template: panic if predefined escapers are found in pipelines during rewriting ... Report an error if a predefined escaper (i.e. "html", "urlquery", or "js") is found in a pipeline that will be rewritten by the contextual auto-escaper, instead of trying to merge the escaper-inserted escaping directives with these predefined escapers. This merging behavior is a source of several security and correctness bugs (eee #19336, #19345, #19352, and #19353.) This merging logic was originally intended to ease migration of text/template templates with user-defined escapers to html/template. Now that migration is no longer an issue, this logic can be safely removed. NOTE: this is a backward-incompatible change that fixes known security bugs (see linked issues for more details). It will explicitly break users that attempt to execute templates with pipelines containing predefined escapers. Fixes #19336, #19345, #19352, #19353 Change-Id: I46b0ca8a2809d179c13c0d4f42b63126ed1c3b49 Reviewed-on: https://go-review.googlesource.com/37880 Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>		2017-04-10 15:08:47 +00:00
..
attr.go
clone_test.go	html/template: fix multiple Clones of redefined template	2016-11-15 04:30:20 +00:00
content_test.go
content.go
context.go
css_test.go
css.go
doc.go	all: spell "marshal" and "unmarshal" consistently	2016-11-12 00:13:35 +00:00
error.go	html/template: panic if predefined escapers are found in pipelines during rewriting	2017-04-10 15:08:47 +00:00
escape_test.go	html/template: panic if predefined escapers are found in pipelines during rewriting	2017-04-10 15:08:47 +00:00
escape.go	html/template: panic if predefined escapers are found in pipelines during rewriting	2017-04-10 15:08:47 +00:00
example_test.go
examplefiles_test.go
html_test.go
html.go
js_test.go	html/template: lock in application/json as valid JS test	2016-12-04 03:59:31 +00:00
js.go	html/template: escape JS in application/json script tag	2016-12-04 02:33:58 +00:00
template_test.go	html/template, text/template: docs and fixes for template redefinition	2016-10-24 15:43:24 +00:00
template.go	text/template,html/template: state that Funcs must happen before parsing	2017-03-21 04:07:35 +00:00
transition_test.go
transition.go
url_test.go
url.go	html/template: typo fix	2016-11-14 21:28:31 +00:00