Roland Shoemaker 8ffa475fbd html: only render content literally in the HTML namespace ...

Per the WHATWG HTML specification, section 13.3, only append the literal
content of a text node if we are in the HTML namespace.

Thanks to Mohammad Thoriq Aziz for reporting this issue.

Fixes golang/go#61615
Fixes CVE-2023-3978

Change-Id: I332152904d4e7646bd2441602bcbe591fc655fa4
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1942896
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com>
Reviewed-on: https://go-review.googlesource.com/c/net/+/514896
Reviewed-by: Roland Shoemaker <roland@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Damien Neil <dneil@google.com>

2023-08-01 17:41:59 +00:00

..

atom

all: go fmt ./...

2021-02-20 03:31:24 +00:00

charset

html: improve coding style

2019-12-07 00:06:13 +00:00

testdata

html: port html5lib tests from html5lib/html5lib-tests

2020-10-29 22:17:08 +00:00

comment_test.go

html: have Render escape comments less often

2023-02-28 08:42:21 +00:00

const.go

html: add comments indicating that these have been removed from the spec

2020-10-10 22:47:23 +00:00

doc.go

html: another shot at security doc

2023-04-17 17:44:42 +00:00

doctype.go

go.net/html: move exp/html and exp/html/atom here to the go.net

2013-02-11 11:55:20 +11:00

entity_test.go

go.net/html: move exp/html and exp/html/atom here to the go.net

2013-02-11 11:55:20 +11:00

entity.go

html: gofmt -w -s

2018-05-08 21:14:25 +00:00

escape_test.go

go.net/html: put escaping tests escape_test.go

2013-07-10 17:32:24 +10:00

escape.go

html: have Render escape comments less often

2023-02-28 08:42:21 +00:00

example_test.go

go.net: use golang.org/x/... import paths

2014-11-10 09:04:43 +11:00

foreign.go

html: remove a few attributes from svg attribute adjustments

2020-10-20 06:53:57 +00:00

node_test.go

go.net/html: move exp/html and exp/html/atom here to the go.net

2013-02-11 11:55:20 +11:00

node.go

html: add the RawNode NodeType

2020-02-02 09:46:26 +00:00

parse_test.go

html: ignore templates nested within foreign content

2021-05-20 17:08:46 +00:00

parse.go

all: fix some comments

2023-02-08 14:49:55 +00:00

render_test.go

html: only render content literally in the HTML namespace

2023-08-01 17:41:59 +00:00

render.go

html: only render content literally in the HTML namespace

2023-08-01 17:41:59 +00:00

token_test.go

html: handle equals sign before attribute

2023-06-20 17:16:42 +00:00

token.go

html: handle equals sign before attribute

2023-06-20 17:16:42 +00:00