Roland Shoemaker
|
8ffa475fbd
|
html: only render content literally in the HTML namespace
Per the WHATWG HTML specification, section 13.3, only append the literal
content of a text node if we are in the HTML namespace.
Thanks to Mohammad Thoriq Aziz for reporting this issue.
Fixes golang/go#61615
Fixes CVE-2023-3978
Change-Id: I332152904d4e7646bd2441602bcbe591fc655fa4
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1942896
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com>
Reviewed-on: https://go-review.googlesource.com/c/net/+/514896
Reviewed-by: Roland Shoemaker <roland@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Damien Neil <dneil@google.com>
|
2023-08-01 17:41:59 +00:00 |
|
Nigel Tao
|
0699458419
|
html: escape comment and doctype tokens' data
Fixes golang/go#48237
Change-Id: I309e3ad30684fb71b9b3e67dfac156da08dbc69b
Reviewed-on: https://go-review.googlesource.com/c/net/+/419334
Run-TryBot: Nigel Tao <nigeltao@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Kunpei Sakai <namusyaka@gmail.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
|
2022-07-26 23:03:23 +00:00 |
|
Nigel Tao
|
16171245cf
|
html: add the RawNode NodeType
Fixes golang/go#36350
Change-Id: Ia11b65940949b7da996b194d48372bc6219d4baa
Reviewed-on: https://go-review.googlesource.com/c/net/+/216800
Reviewed-by: Kunpei Sakai <namusyaka@gmail.com>
Reviewed-by: Nigel Tao <nigeltao@golang.org>
Run-TryBot: Kunpei Sakai <namusyaka@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
|
2020-02-02 09:46:26 +00:00 |
|
Nigel Tao
|
ea127e889c
|
go.net/html: move exp/html and exp/html/atom here to the go.net
sub-repo.
It's a straight copy, except for these modifications:
* "exp/html" and "exp/html/atom" imports were renamed, and
* the "TODO... When this package moves out of exp" comment was
deleted from atom/atom.go.
The matching change is at https://golang.org/cl/7317043
The rationale was discussed at
https://groups.google.com/d/topic/golang-nuts/Qq5hTQyPuLg/discussion
R=adg, remyoudompheng, dave
CC=golang-dev
https://golang.org/cl/7310063
|
2013-02-11 11:55:20 +11:00 |
|