Commit 79669dc7 authored by Tom Thorogood's avatar Tom Thorogood Committed by Daniel Martí

encoding/json: revert Compact HTML escaping documentation

This partly reverts CL 173417 as it incorrectly documented that Compact
performed HTML escaping and the output was safe to embed inside HTML
<script> tags. This has never been true.

Although Compact does escape U+2028 and U+2029, it doesn't escape <, >
or &. Compact is thus only performing a subset of HTML escaping and it's
output is not safe to embed inside HTML <script> tags.

A more complete fix would be for Compact to either never perform any
HTML escaping, as it was prior to CL 10883045, or to actually perform
the same HTML escaping as HTMLEscape. Neither change is likely safe
enough for go1.13.

Updates #30357

Change-Id: I912f0fe9611097d988048b28228c4a5b985080ba
GitHub-Last-Rev: aebababc9233c5705785b225377e80096d4bb8c4
GitHub-Pull-Request: golang/go#33427
Reviewed-on: https://go-review.googlesource.com/c/go/+/188717Reviewed-by: default avatarDaniel Martí <mvdan@mvdan.cc>
Run-TryBot: Daniel Martí <mvdan@mvdan.cc>
TryBot-Result: Gobot Gobot <gobot@golang.org>
parent 85f3ca74
......@@ -8,9 +8,6 @@ import "bytes"
// Compact appends to dst the JSON-encoded src with
// insignificant space characters elided.
// Like Marshal, Compact applies HTMLEscape to any
// string literals so that the JSON will be safe to embed
// inside HTML <script> tags.
func Compact(dst *bytes.Buffer, src []byte) error {
return compact(dst, src, false)
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment