Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

html/template: tags are stripped in attributes for template.HTML type #22795

Closed
ghost opened this issue Nov 18, 2017 · 1 comment
Closed

html/template: tags are stripped in attributes for template.HTML type #22795

ghost opened this issue Nov 18, 2017 · 1 comment

Comments

@ghost
Copy link

ghost commented Nov 18, 2017

Not sure if it's a bug, but it is certainly a little surprising. Reported here.

What version of Go are you using (go version)?

1.9.2

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/opennota/gocode"
GORACE=""
GOROOT="/home/opennota/go"
GOTOOLDIR="/home/opennota/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build049660887=/tmp/go-build -gno-record-gcc-switches"
CXX="g++"
CGO_ENABLED="1"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"

What did you do?

https://play.golang.org/p/sfuDrve8rZ

What did you expect to see?

<input value="<b>text</b>"> or <input value="&lt;b&gt;text&lt;/b&gt;">

What did you see instead?

<input value="text">

@titanous
Copy link
Member

This is working as intended. Use HTMLAttr to opt-in to the potentially unsafe behavior of including unescaped HTML in attribute values.

@golang golang locked and limited conversation to collaborators Nov 21, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

2 participants