mirror of
https://github.com/gohugoio/hugo.git
synced 2025-08-29 22:29:56 +02:00
@@ -4,6 +4,18 @@ package template
|
||||
|
||||
import "strconv"
|
||||
|
||||
func _() {
|
||||
// An "invalid array index" compiler error signifies that the constant values have changed.
|
||||
// Re-run the stringer command to generate them again.
|
||||
var x [1]struct{}
|
||||
_ = x[attrNone-0]
|
||||
_ = x[attrScript-1]
|
||||
_ = x[attrScriptType-2]
|
||||
_ = x[attrStyle-3]
|
||||
_ = x[attrURL-4]
|
||||
_ = x[attrSrcset-5]
|
||||
}
|
||||
|
||||
const _attr_name = "attrNoneattrScriptattrScriptTypeattrStyleattrURLattrSrcset"
|
||||
|
||||
var _attr_index = [...]uint8{0, 8, 18, 32, 41, 48, 58}
|
||||
|
@@ -4,6 +4,16 @@ package template
|
||||
|
||||
import "strconv"
|
||||
|
||||
func _() {
|
||||
// An "invalid array index" compiler error signifies that the constant values have changed.
|
||||
// Re-run the stringer command to generate them again.
|
||||
var x [1]struct{}
|
||||
_ = x[delimNone-0]
|
||||
_ = x[delimDoubleQuote-1]
|
||||
_ = x[delimSingleQuote-2]
|
||||
_ = x[delimSpaceOrTagEnd-3]
|
||||
}
|
||||
|
||||
const _delim_name = "delimNonedelimDoubleQuotedelimSingleQuotedelimSpaceOrTagEnd"
|
||||
|
||||
var _delim_index = [...]uint8{0, 9, 25, 41, 59}
|
||||
|
@@ -5,16 +5,16 @@
|
||||
/*
|
||||
Package template (html/template) implements data-driven templates for
|
||||
generating HTML output safe against code injection. It provides the
|
||||
same interface as package text/template and should be used instead of
|
||||
text/template whenever the output is HTML.
|
||||
same interface as [text/template] and should be used instead of
|
||||
[text/template] whenever the output is HTML.
|
||||
|
||||
The documentation here focuses on the security features of the package.
|
||||
For information about how to program the templates themselves, see the
|
||||
documentation for text/template.
|
||||
documentation for [text/template].
|
||||
|
||||
# Introduction
|
||||
|
||||
This package wraps package text/template so you can share its template API
|
||||
This package wraps [text/template] so you can share its template API
|
||||
to parse and execute HTML templates safely.
|
||||
|
||||
tmpl, err := template.New("name").Parse(...)
|
||||
|
@@ -4,6 +4,17 @@ package template
|
||||
|
||||
import "strconv"
|
||||
|
||||
func _() {
|
||||
// An "invalid array index" compiler error signifies that the constant values have changed.
|
||||
// Re-run the stringer command to generate them again.
|
||||
var x [1]struct{}
|
||||
_ = x[elementNone-0]
|
||||
_ = x[elementScript-1]
|
||||
_ = x[elementStyle-2]
|
||||
_ = x[elementTextarea-3]
|
||||
_ = x[elementTitle-4]
|
||||
}
|
||||
|
||||
const _element_name = "elementNoneelementScriptelementStyleelementTextareaelementTitle"
|
||||
|
||||
var _element_index = [...]uint8{0, 11, 24, 36, 51, 63}
|
||||
|
@@ -216,18 +216,13 @@ const (
|
||||
// disallowed. Avoid using "html" and "urlquery" entirely in new templates.
|
||||
ErrPredefinedEscaper
|
||||
|
||||
// errJSTmplLit: "... appears in a JS template literal"
|
||||
// ErrJSTemplate: "... appears in a JS template literal"
|
||||
// Example:
|
||||
// <script>var tmpl = `{{.Interp}`</script>
|
||||
// <script>var tmpl = `{{.Interp}}`</script>
|
||||
// Discussion:
|
||||
// Package html/template does not support actions inside of JS template
|
||||
// literals.
|
||||
//
|
||||
// TODO(rolandshoemaker): we cannot add this as an exported error in a minor
|
||||
// release, since it is backwards incompatible with the other minor
|
||||
// releases. As such we need to leave it unexported, and then we'll add it
|
||||
// in the next major release.
|
||||
errJSTmplLit
|
||||
ErrJSTemplate
|
||||
)
|
||||
|
||||
func (e *Error) Error() string {
|
||||
|
@@ -8,6 +8,8 @@ import (
|
||||
"bytes"
|
||||
"fmt"
|
||||
"html"
|
||||
|
||||
//"internal/godebug"
|
||||
"io"
|
||||
|
||||
template "github.com/gohugoio/hugo/tpl/internal/go_templates/texttemplate"
|
||||
@@ -161,6 +163,7 @@ func (e *escaper) escape(c context, n parse.Node) context {
|
||||
panic("escaping " + n.String() + " is unimplemented")
|
||||
}
|
||||
|
||||
// Modified by Hugo.
|
||||
// var debugAllowActionJSTmpl = godebug.New("jstmpllitinterp")
|
||||
|
||||
// escapeAction escapes an action template node.
|
||||
@@ -227,12 +230,13 @@ func (e *escaper) escapeAction(c context, n *parse.ActionNode) context {
|
||||
case stateJSDqStr, stateJSSqStr:
|
||||
s = append(s, "_html_template_jsstrescaper")
|
||||
case stateJSBqStr:
|
||||
if SecurityAllowActionJSTmpl.Load() { // .Value() == "1" {
|
||||
if SecurityAllowActionJSTmpl.Load() {
|
||||
//debugAllowActionJSTmpl.IncNonDefault()
|
||||
s = append(s, "_html_template_jsstrescaper")
|
||||
} else {
|
||||
return context{
|
||||
state: stateError,
|
||||
err: errorf(errJSTmplLit, n, n.Line, "%s appears in a JS template literal", n),
|
||||
err: errorf(ErrJSTemplate, n, n.Line, "%s appears in a JS template literal", n),
|
||||
}
|
||||
}
|
||||
case stateJSRegexp:
|
||||
@@ -756,7 +760,7 @@ func (e *escaper) escapeText(c context, n *parse.TextNode) context {
|
||||
} else if isComment(c.state) && c.delim == delimNone {
|
||||
switch c.state {
|
||||
case stateJSBlockCmt:
|
||||
// https://es5.github.com/#x7.4:
|
||||
// https://es5.github.io/#x7.4:
|
||||
// "Comments behave like white space and are
|
||||
// discarded except that, if a MultiLineComment
|
||||
// contains a line terminator character, then
|
||||
|
@@ -925,7 +925,7 @@ func TestJSEscaping(t *testing.T) {
|
||||
{`'foo`, `\'foo`},
|
||||
{`Go "jump" \`, `Go \"jump\" \\`},
|
||||
{`Yukihiro says "今日は世界"`, `Yukihiro says \"今日は世界\"`},
|
||||
{"unprintable \uFDFF", `unprintable \uFDFF`},
|
||||
{"unprintable \uFFFE", `unprintable \uFFFE`},
|
||||
{`<html>`, `\u003Chtml\u003E`},
|
||||
{`no = in attributes`, `no \u003D in attributes`},
|
||||
{`' does not become HTML entity`, `\u0026#x27; does not become HTML entity`},
|
||||
|
@@ -397,7 +397,7 @@ func tLineCmt(c context, s []byte) (context, int) {
|
||||
return c, len(s)
|
||||
}
|
||||
c.state = endState
|
||||
// Per section 7.4 of EcmaScript 5 : https://es5.github.com/#x7.4
|
||||
// Per section 7.4 of EcmaScript 5 : https://es5.github.io/#x7.4
|
||||
// "However, the LineTerminator at the end of the line is not
|
||||
// considered to be part of the single-line comment; it is
|
||||
// recognized separately by the lexical grammar and becomes part
|
||||
|
@@ -4,6 +4,16 @@ package template
|
||||
|
||||
import "strconv"
|
||||
|
||||
func _() {
|
||||
// An "invalid array index" compiler error signifies that the constant values have changed.
|
||||
// Re-run the stringer command to generate them again.
|
||||
var x [1]struct{}
|
||||
_ = x[urlPartNone-0]
|
||||
_ = x[urlPartPreQuery-1]
|
||||
_ = x[urlPartQueryOrFrag-2]
|
||||
_ = x[urlPartUnknown-3]
|
||||
}
|
||||
|
||||
const _urlPart_name = "urlPartNoneurlPartPreQueryurlPartQueryOrFragurlPartUnknown"
|
||||
|
||||
var _urlPart_index = [...]uint8{0, 11, 26, 44, 58}
|
||||
|
Reference in New Issue
Block a user