Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

html/template: Go 1.8 has a different encoding logic for application/ld+json and text/javascript #20886

Closed
ARolek opened this issue Jul 2, 2017 · 6 comments
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone

Comments

@ARolek
Copy link

ARolek commented Jul 2, 2017

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

1.8.3

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN="/Users/arolek/Dev/active/go/bin"
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/arolek/Dev/active/go"
GORACE=""
GOROOT="/usr/local/go"
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/vn/7h5q9_3d19jg95pw_tbdwspr0000gn/T/go-build069492838=/tmp/go-build -gno-record-gcc-switches -fno-common"
CXX="clang++"
CGO_ENABLED="1"
PKG_CONFIG="pkg-config"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"

What did you do?

  • Tested this script

What did you expect to see?

  • The JSON output to not be escaped when inside of <script type="application/ld+json"> when using template.JS.

What did you see instead?

  • The JSON output was escaped when inside of <script type="application/ld+json"> when using template.JS

I believe this is a similar issue to #18159 and that application/ld+json needs to be added to the isJSType mime type list.

@ARolek ARolek changed the title html/template: Go 1.8 has a different encoding logic html/template: Go 1.8 has a different encoding logic for application/ld+json and text/javascript Jul 2, 2017
@odeke-em
Copy link
Member

/cc @nodirt @rsc @mikesamuel

@odeke-em
Copy link
Member

Regression from Go1.7 but it was not fixed in Go1.8, am wondering what milestone we should triage this bug for, @bradfitz.

@mikesamuel
Copy link
Contributor

The operative part of the code is src/htm/template/escape.go:711

	// If this is a non-JS "type" attribute inside "script" tag, do not treat the contents as JS.
  	if c.state == stateAttr && c.element == elementScript && c.attr == attrScriptType && !isJSType(string(s[:i])) {
  		element = elementNone
  	}

We'd need to update the list in js.go:382

	case
  		"application/ecmascript",
  		"application/javascript",
  		"application/json",
  		"application/x-ecmascript",
  		"application/x-javascript",
  		"text/ecmascript",
  		"text/javascript",
  		"text/javascript1.0",
  		"text/javascript1.1",
  		"text/javascript1.2",
  		"text/javascript1.3",
  		"text/javascript1.4",
  		"text/javascript1.5",
  		"text/jscript",
  		"text/livescript",
  		"text/x-ecmascript",
  		"text/x-javascript":
  		return true

@mikesamuel
Copy link
Contributor

mikesamuel commented Jul 10, 2017

Do we need to skip the parentheses around the encoded map in your example code?

IIRC, interpolating a map into a script context will wrap in parentheses to avoid the problem noted in EcmaScript 6 Sec 13.5

13.5 Expression Statement

Syntax

ExpressionStatement[Yield] :

  • [lookahead ∉ {{, function, class, let ]}] Expression[In, ?Yield] ;

NOTE An ExpressionStatement cannot start with a U+007B (LEFT CURLY BRACKET) because that might make it ambiguous with a Block.

@ALTree
Copy link
Member

ALTree commented Jul 11, 2017

@odeke-em I'd say go1.10. Doubt that something that was already broken in go1.8 will be fixed for 1.9, at this point go1.9 is done.

@ALTree ALTree added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jul 11, 2017
@ALTree ALTree added this to the Go1.10 milestone Jul 11, 2017
@rsc
Copy link
Contributor

rsc commented Nov 22, 2017

For better or worse, the Go1.8+ behavior is now the de facto expected behavior.

@rsc rsc closed this as completed Nov 22, 2017
@golang golang locked and limited conversation to collaborators Nov 22, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Development

No branches or pull requests

6 participants