What version of Go are you using (go version)?

go version go1.13 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

Not relevant

What did you do?

	const (
		user1 = ":foo:"
		user2 = "_foo_"
	)
	tok := xsrftoken.Generate("key", user1, "action")
	fmt.Println(xsrftoken.Valid(tok, "key", user2, "action"))

What did you expect to see?

"false"

What did you see instead?

"true"

More info

This is due to a pre-processing of the input that replaces : with _ (colons are internally used as separators) thus creating a clash between different users (in this example the user _foo_ can obtain valid tokens for user :foo: and viceversa).

I would advise to properly escape colons instead of replacing them with underscores. The risk is that, otherwise, a service that allows users to pick their own IDs would be exposed to CSRF protection bypass.

One example of fix would be to change the clean function to this:

func clean(s string) string {
	s = strings.Replace(s, `\`, `\\`, -1)
	return strings.Replace(s, `:`, `\:`, -1)
}

Note: I already discussed this with @andybons and we agreed it is low risk enough to open a public bug for.

cc/ @bradfitz @FiloSottile @dgryski