html/template

New Issue

esoteric `jsCtx` bugs that may lead to XSSNeedsInvestigation

#81541 opened 1 week ago by thatnealpatel

JS context is not reset when template literal closesNeedsInvestigation

#81117 opened 1 month ago by neild

incorrectly classifies regexp literals after await and yield leading to potential XSSNeedsFix

#80897 opened 1 month ago by inimicalx2193

iframe refererrpolicy attribute not properly escapedNeedsInvestigation

#80163 opened 3 months ago by rolandshoemaker

ping attribute not properly escapedNeedsInvestigation

#80162 opened 3 months ago by rolandshoemaker

incomplete jsBraceDepth CVE-2026-32289 fixNeedsInvestigation

#80161 opened 3 months ago by rolandshoemaker

various SVG attributes not escapedNeedsInvestigation

#80158 opened 3 months ago by rolandshoemaker

iframe srcdoc attribute not properly escapedFixPendingNeedsFixSecurity

#80154 opened 3 months ago by rolandshoemaker

attribute scanning does not treat / as a token boundary, unlike HTMLNeedsInvestigation

#79773 opened 3 months ago by thatnealpatel

consider applying meta refresh URL filtering to implicit URL syntaxNeedsInvestigation

#79644 opened 4 months ago by Saku0512

prevent CPU exhaustion in contextual escaper via recursion depth limitFixPending

#79014 opened 4 months ago by owvr27

XSS due to templates such as <a href="{{.Scheme}}:{{.Body}}">LibraryProposalNeedsInvestigation

#78828 opened 5 months ago by nicholashusin

incorrect duplicate type attribute processing in <script> tags leading to insufficient escapingBugReportNeedsInvestigation

#78039 opened 6 months ago by vyivel

provide JS variable population helper, disable arbitrary template actions inside of <script> contextsNeedsInvestigationSecurityThinking

#77031 opened 9 months ago by rolandshoemaker

Template.ExecuteLite skip resolution to methods to allow DCELibraryProposalProposal

#72895 opened 2 years ago by seankhliao

export filters and escapersProposal

#70375 opened 2 years ago by apleshkov

add a formatterProposal

#69413 opened 2 years ago by josharian

template Parse/Execute escaping raceNeedsDecisionSecurity

#69404 opened 2 years ago by rolandshoemaker

building pages dynamically with one function callProposal

#65924 opened 2 years ago by HarrisonHemstreet

incorrect parsing of script element with CDATA tag since 1.21.1NeedsInvestigation

#63464 opened 3 years ago by niallnsec

investigate using x/net/html for parsingNeedsInvestigation

#63392 opened 3 years ago by rolandshoemaker

investigate rewriting the JS parserNeedsInvestigation

#63371 opened 3 years ago by rolandshoemaker

comment handling introduced in 1.21.1 breaks valid scriptsNeedsInvestigationSecurity

#63183 opened 3 years ago by jupenur

unrecognized failuresNeedsInvestigation

#63052 opened 3 years ago by gopherbot

treatment of CDATA sections in foreign content diverges from browsersNeedsFixSecurity

#62617 opened 3 years ago by rolandshoemaker

add ExecuteFuncsFixPendingProposalProposal-Accepted

#54450 opened 4 years ago by zeripath

allow output of some html commentsProposal

#54380 opened 4 years ago by kbolino

default missingkey behavior does not match documentationDocumentationNeedsInvestigationhelp wanted

#54053 opened 4 years ago by rittneje

Parsing invalid templates with no actions should fail-fastNeedsInvestigation

#52906 opened 4 years ago by josharian

AddParseTree does not set root template correctlyNeedsInvestigation

#48477 opened 5 years ago by bluekeyes

imagesrcset incorrectly escapedNeedsInvestigation

#47452 opened 5 years ago by hoox

escape unquoted attributes by first quoting themProposal

#43224 opened 5 years ago by empijei

escapes + to +NeedsDecision

#42506 opened 5 years ago by Dynom

unexpected semantic differences compared to text/templateNeedsInvestigation

#40075 opened 6 years ago by rsc

improve context representation for user-facing error messagesNeedsInvestigation

#30635 opened 7 years ago by empijei

SGML processing Instructions escapedNeedsDecision

#30168 opened 7 years ago by bep

ambiguous errors when style tag is not closedNeedsInvestigation

#29269 opened 7 years ago by noonien

does not recognize rgb() as a CSS colorNeedsInvestigationhelp wanted

#25446 opened 8 years ago by daviddengcn

parse failures lack sufficient context for debuggingNeedsInvestigation

#20773 opened 9 years ago by michaelsafyan

dynamic substrings in HTML tags or attributes can result in unsafe HTML outputNeedsFixhelp wanted

#19669 opened 9 years ago by stjj89

improve ErrBadHTML error reportNeedsFix

#19408 opened 9 years ago by perillo

provide a way to specify the initial escaping context (JS or CSS) when parsingFeatureRequestNeedsInvestigation

#8762 opened 12 years ago by bradleypeabody