html/template

New Issue

reserved character "()" in href attribute is autoescaped.NeedsInvestigationSecurity

#63586 opened 1 month ago by gyuber

Incorrect parsing of script element with CDATA tag since 1.21.1NeedsInvestigation

#63464 opened 1 month ago by niallnsec

investigate using x/net/html for parsingNeedsInvestigation

#63392 opened 1 month ago by rolandshoemaker

investigate rewriting the JS parserNeedsInvestigation

#63371 opened 2 months ago by rolandshoemaker

comment handling introduced in 1.21.1 breaks valid scripts [1.21 backport]CherryPickApprovedSecurityWaitingForInfo

#63208 opened 2 months ago by gopherbot

comment handling introduced in 1.21.1 breaks valid scripts [1.20 backport]CherryPickApprovedSecurityWaitingForInfo

#63207 opened 2 months ago by gopherbot

comment handling introduced in 1.21.1 breaks valid scriptsNeedsInvestigationSecurity

#63183 opened 2 months ago by jupenur

unrecognized failuresNeedsInvestigation

#63052 opened 2 months ago by gopherbot

treatment of CDATA sections in foreign content diverges from browsersNeedsFixSecurity

#62617 opened 2 months ago by rolandshoemaker

refuse to parse complex JS template literalsProposalProposal-AcceptedProposal-Security

#60055 opened 6 months ago by rolandshoemaker

script type attribute inside condition causes an error NeedsInvestigation

#59112 opened 8 months ago by willfaught

add ExecuteFuncsProposalProposal-Accepted

#54450 opened 1 year ago by zeripath

Better handling of HTML commentsProposal

#54380 opened 1 year ago by kbolino

default missingkey behavior does not match documentationDocumentationNeedsInvestigationhelp wanted

#54053 opened 1 year ago by rittneje

URL types always escape in attributesNeedsInvestigation

#53342 opened 1 year ago by weberc2

Parsing invalid templates with no actions should fail-fastNeedsInvestigation

#52906 opened 2 years ago by josharian

AddParseTree does not set root template correctlyNeedsInvestigation

#48477 opened 2 years ago by bluekeyes

imagesrcset incorrectly escapedNeedsInvestigation

#47452 opened 2 years ago by hoox

JS context breaks after a quoted </script>NeedsInvestigation

#43730 opened 2 years ago by maraino

escape unquoted attributes by first quoting themProposal

#43224 opened 3 years ago by empijei

Tree is only updated after Execute is calledDocumentationNeedsFix

#43064 opened 3 years ago by vktec

escapes + to +NeedsDecision

#42506 opened 3 years ago by Dynom

unexpected semantic differences compared to text/templateNeedsInvestigation

#40075 opened 3 years ago by rsc

inconsistent JSON output behaviorNeedsInvestigation

#38895 opened 3 years ago by xrfang

incorrectly escapes urls with fragmentsNeedsInvestigation

#36096 opened 4 years ago by takeda

document ability to modify FuncMap after template parse by calling Funcs againDocumentationNeedsFixhelp wanted

#34680 opened 4 years ago by michaelsafyan

improve context representation for user-facing error messagesNeedsInvestigation

#30635 opened 4 years ago by empijei

SGML processing Instructions escapedNeedsDecision

#30168 opened 4 years ago by bep

ambiguous errors when style tag is not closedNeedsInvestigation

#29269 opened 5 years ago by noonien

document that it strips commentsDocumentationNeedsFixhelp wanted

#28628 opened 5 years ago by magical

does not recognize rgb() as a CSS colorNeedsInvestigationhelp wanted

#25446 opened 5 years ago by daviddengcn

parse failures lack sufficient context for debuggingNeedsInvestigation

#20773 opened 6 years ago by michaelsafyan

dynamic substrings in HTML tags or attributes can result in unsafe HTML outputNeedsFixhelp wanted

#19669 opened 6 years ago by stjj89

improve ErrBadHTML error reportNeedsFix

#19408 opened 6 years ago by perillo

add support for template strings (backticks)NeedsDecision

#9200 opened 9 years ago by gopherbot

provide a way to specify the initial escaping context (JS or CSS) when parsing

#8762 opened 9 years ago by bradleypeabody