mirror/hugo
1
0
Fork 0
mirror of https://github.com/gohugoio/hugo.git synced 2025-08-21 21:35:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix upstream Go templates bug with reversed key/value assignment

Browse Source 
The template packages are based on go1.20.5 with the patch in befec5ddbbfbd81ec84e74e15a38044d67f8785b  added.

This also includes a security fix that now disallows Go template actions in JS literals (inside backticks).

This will throw an error saying "... appears in a JS template literal".

If you're really sure this isn't a security risk in your case, you can revert to the old behaviour:

```toml
[security]
[security.gotemplates]
allowActionJSTmpl = true
```

See https://github.com/golang/go/issues/59234

Fixes #11112
This commit is contained in:
Bjørn Erik Pedersen
2023-06-15 16:34:16 +02:00
parent 0f989d5e21
commit ee359df172
24 changed files with 276 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
tpl/internal/go_templates/texttemplate/exec.go
View File

@@ -361,19 +361,27 @@ func (s *state) walkRange(dot reflect.Value, r *parse.RangeNode) {
// mark top of stack before any variables in the body are pushed.
mark := s.mark()
oneIteration := func(index, elem reflect.Value) {
// Set top var (lexically the second if there are two) to the element.
if len(r.Pipe.Decl) > 0 {
if r.Pipe.IsAssign {
s.setVar(r.Pipe.Decl[0].Ident[0], elem)
// With two variables, index comes first.
// With one, we use the element.
if len(r.Pipe.Decl) > 1 {
s.setVar(r.Pipe.Decl[0].Ident[0], index)
} else {
s.setVar(r.Pipe.Decl[0].Ident[0], elem)
}
} else {
// Set top var (lexically the second if there
// are two) to the element.
s.setTopVar(1, elem)
}
}
// Set next var (lexically the first if there are two) to the index.
if len(r.Pipe.Decl) > 1 {
if r.Pipe.IsAssign {
s.setVar(r.Pipe.Decl[1].Ident[0], index)
s.setVar(r.Pipe.Decl[1].Ident[0], elem)
} else {
// Set next var (lexically the first if there
// are two) to the index.
s.setTopVar(2, index)
}
}