Roland Shoemaker ccbc725f2d html/template: escape additional tokens in MarshalJSON errors ...

Escape "</script" and "<!--" in errors returned from MarshalJSON errors
when attempting to marshal types in script blocks. This prevents any
user controlled content from prematurely terminating the script block.

Fixes #65697

Change-Id: Icf0e26c54ea7d9c1deed0bff11b6506c99ddef1b
Reviewed-on: https://go-review.googlesource.com/c/go/+/564196
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>

2024-02-27 02:20:11 +00:00

..

template

html/template: escape additional tokens in MarshalJSON errors

2024-02-27 02:20:11 +00:00

entity_test.go

…

entity.go

…

escape_test.go

…

escape.go

…

example_test.go

…

fuzz_test.go

html: convert fuzz test to native Go fuzzing

2023-05-10 20:35:20 +00:00