src/pkg/exp/template/html/escape.go · 582bb304662f2da08f99bf7d05d3fbb634bb531b · Kirill Smelkov / go

exp/template/html: don't normalize '<' in doctypes. · 582bb304

Mike Samuel authored Sep 28, 2011

The normalization that prevents element name and comment injection in
  <{{.}}
by converting it to
  &lt;{{.}}
breaks
  <!DOCTYPE html>

Instead of splitting states to have a start of document state and a text
state, I whitelist <!DOCTYPE.

R=nigeltao
CC=golang-dev
https://golang.org/cl/5131051

582bb304

escape.go 22 KB

Replace escape.go