Gregory Man aa69164e44 xsrftoken: escape colons ...

The current clean() replaces : with _ (colons are internally used as
separators).
This produce can produce same output for different inputs, for example
the user _foo_ can obtain valid tokens for user :foo:.

This CL replace colons with double colons instead of replacing them
with underscores.

Fixes golang/go#34308

Change-Id: I3e4148a0836e62fda1a5f0ba32b375121368afd3
Reviewed-on: https://go-review.googlesource.com/c/net/+/196457
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

2019-09-23 16:28:16 +00:00

..

xsrf_test.go

xsrftoken: escape colons

2019-09-23 16:28:16 +00:00

xsrf.go

xsrftoken: escape colons

2019-09-23 16:28:16 +00:00