html/template

New Issue

errors returned from MarshalJSON are not correctly escaped [1.22 backport]CherryPickApprovedSecurity

#65969 opened 1 month ago by gopherbot

errors returned from MarshalJSON are not correctly escaped [1.21 backport]CherryPickApprovedSecurity

#65968 opened 1 month ago by gopherbot

errors returned from MarshalJSON are not correctly escapedNeedsFixSecurity

#65697 opened 2 months ago by rolandshoemaker

Some characters cannot be used in the template.

#65289 opened 2 months ago by k-takeuchi220

Since 2024, if on Zero value date is true

#64948 opened 3 months ago by dstpierre

comment handling introduced in 1.21.1 breaks valid scripts [1.20 backport]CherryPickApprovedSecurityWaitingForInfo

#63207 opened 6 months ago by gopherbot

improper handling of special tags within script contexts (CVE-2023-39319) [1.21 backport]CherryPickApprovedSecurityrelease-blocker

#62398 opened 7 months ago by gopherbot

improper handling of special tags within script contexts (CVE-2023-39319) [1.20 backport]CherryPickApprovedSecurityrelease-blocker

#62397 opened 7 months ago by gopherbot

improper handling of HTML-like comments within script contexts (CVE-2023-39318) [1.21 backport]CherryPickApprovedSecurityrelease-blocker

#62396 opened 7 months ago by gopherbot

improper handling of HTML-like comments within script contexts (CVE-2023-39318) [1.20 backport]CherryPickApprovedSecurityrelease-blocker

#62395 opened 7 months ago by gopherbot

improper handling of special tags within script contexts (CVE-2023-39319)NeedsFixSecurityrelease-blocker

#62197 opened 8 months ago by rolandshoemaker

improper handling of HTML-like comments within script contexts (CVE-2023-39318)NeedsFixSecurityrelease-blocker

#62196 opened 8 months ago by rolandshoemaker

allow actions in JS template literalsProposalProposal-Accepted

#61619 opened 8 months ago by rolandshoemaker

improper handling of empty HTML attributesNeedsFixSecurityrelease-blocker

#59722 opened 1 year ago by rolandshoemaker

improper handling of JavaScript whitespaceNeedsFixSecurityrelease-blocker

#59721 opened 1 year ago by rolandshoemaker

improper sanitization of CSS valuesNeedsFixSecurityrelease-blocker

#59720 opened 1 year ago by rolandshoemaker

expose ErrJSTemplateProposalProposal-AcceptedProposal-Security

#59584 opened 1 year ago by rolandshoemaker

When referencing a template, the path cannot be a variableFrozenDueToAge

#59444 opened 1 year ago by springrain

backticks not treated as string delimiters (CVE-2023-24538) [1.20 backport]CherryPickApprovedFrozenDueToAgeSecurity

#59272 opened 1 year ago by gopherbot

backticks not treated as string delimiters (CVE-2023-24538) [1.19 backport]CherryPickApprovedFrozenDueToAgeSecurity

#59271 opened 1 year ago by gopherbot

backticks not treated as string delimiters (CVE-2023-24538)FrozenDueToAgeNeedsFixSecurity

#59234 opened 1 year ago by rolandshoemaker

Unexpected resultFrozenDueToAge

#58460 opened 1 year ago by jmooring

script type attribute: {{if}} branches end in different contextsFrozenDueToAgeNeedsInvestigation

#57136 opened 1 year ago by melato

genereates broken result when there is JS string interpolationFrozenDueToAge

#55341 opened 2 years ago by wxiaoguang

{{range}} branches end in different contextsFrozenDueToAgeNeedsInvestigation

#54999 opened 2 years ago by timdadd

an infinite recursion in Template.Execute() FrozenDueToAgeNeedsInvestigation

#53241 opened 2 years ago by secsys-go

Execute is not concurrent safeFrozenDueToAgeNeedsInvestigationWaitingForInfo

#51344 opened 2 years ago by bep

Error .. in attribute nameFrozenDueToAgeWaitingForInfo

#51065 opened 2 years ago by anoop012345

incorrect js inside <script>FrozenDueToAge

#47616 opened 2 years ago by acoshift

data race with concurrent ExecuteTemplate calls [1.16 backport]CherryPickApprovedFrozenDueToAge

#47042 opened 2 years ago by gopherbot

data race with concurrent ExecuteTemplate calls [1.15 backport]CherryPickCandidateFrozenDueToAge

#47041 opened 2 years ago by gopherbot

data race with concurrent ExecuteTemplate callsFrozenDueToAgeNeedsFix

#47040 opened 2 years ago by josharian

make FuncMap an alias for text/template.FuncMapFrozenDueToAgeProposalProposal-AcceptedProposal-FinalCommentPeriod

#46121 opened 2 years ago by rogpeppe

sync: RUnlock of unlocked RWMutex [Go 1.16 regression]FrozenDueToAge

#43885 opened 3 years ago by eclipseo

deadlock if "dot" method is used to execute template from same setFrozenDueToAgeNeedsFixrelease-blocker

#43855 opened 3 years ago by ianlancetaylor

CL 274450 (in go1.16beta1) causes panicFrozenDueToAgeNeedsInvestigationrelease-blocker

#43295 opened 3 years ago by stapelberg

add LookupFunc, LookupOption methodsFrozenDueToAgeProposal

#43062 opened 3 years ago by jba

data race in ExecuteFrozenDueToAgeNeedsFix

#39807 opened 3 years ago by bep

Paths in attributes not escaped correctlyFrozenDueToAgeNeedsInvestigation

#38837 opened 4 years ago by ePirat

unexpected behaviour when using "onclick"FrozenDueToAgeWaitingForInfo

#34691 opened 4 years ago by bakurits

should escape JSON without using \xFrozenDueToAgeNeedsInvestigation

#33671 opened 4 years ago by earthboundkid

user-defined function is not parsed via ParseFilesFrozenDueToAgeWaitingForInfo

#32934 opened 4 years ago by gkarthiks

Errors with parseFiles and FuncsFrozenDueToAge

#31935 opened 5 years ago by LouisBruge

add support for JavaScript modulesFrozenDueToAgeNeedsInvestigationProposalProposal-Accepted

#31327 opened 5 years ago by tomuta

add ExecuteContext methodsFrozenDueToAgeProposal

#31107 opened 5 years ago by empijei

ParseGlob does not document the pattern syntaxDocumentationFrozenDueToAgeNeedsFix

#30608 opened 5 years ago by dmitshur

data race in indirectFrozenDueToAgeWaitingForInfo

#30286 opened 5 years ago by bep

``literal cut offFrozenDueToAgeNeedsInvestigation

#29406 opened 5 years ago by eternal-flame-AD

escapeTemplate causes a panic by invoking fmt.Sprintf("%v") on a context with nil *Error fieldFrozenDueToAgeNeedsFix

#28854 opened 5 years ago by alexbrainman

add a hardened version of it to the standard libraryFrozenDueToAgeProposal

#27926 opened 5 years ago by stjj89

template.HTMLAttr value garbled in style attributeFrozenDueToAge

#27178 opened 5 years ago by bep

"application/ld+json" MIME type is not understood as JSFrozenDueToAgeNeedsFix

#26053 opened 5 years ago by eklitzke

untyped nil now prints "<nil>"FrozenDueToAgeNeedsFixrelease-blocker

#25875 opened 5 years ago by bep

exponential memory usage in srcset processingFrozenDueToAgeNeedsFix

#24731 opened 6 years ago by rhysh

panic when calling function with untyped nilFrozenDueToAgeNeedsFix

#24717 opened 6 years ago by rhysh

asymmetry of text/template and html/template definitionFrozenDueToAgeNeedsFix

#23990 opened 6 years ago by ikrabbe

add break and continueFeatureRequestFrozenDueToAgeNeedsFixhelp wanted

#23683 opened 6 years ago by dgryski

tags are stripped in attributes for template.HTML typeFrozenDueToAge

#22795 opened 6 years ago by opennota

Redefining a template inhibits escapingFrozenDueToAgeNeedsInvestigation

#22780 opened 6 years ago by alin-amana

export stripTags func from html.goFrozenDueToAgeNeedsDecisionSuggested

#22639 opened 6 years ago by anotherGoogleFan

URL path/fragment component not properly escapedFrozenDueToAge

#22498 opened 6 years ago by stjj89

confusing disallowed escapers detection FrozenDueToAgeNeedsInvestigation

#22086 opened 6 years ago by mpl

JS and JSStr incorrectly escaped in javascript contextFrozenDueToAge

#21968 opened 6 years ago by justinclift

template.HTML strings escaped (Go 1.9 regression)FrozenDueToAgeNeedsDecision

#21844 opened 6 years ago by bep

HTMLEscapeString duplicates functionality found in package htmlFrozenDueToAgeNeedsDecision

#20957 opened 6 years ago by mappu

Go 1.8 has a different encoding logic for application/ld+json and text/javascriptFrozenDueToAgeNeedsInvestigation

#20886 opened 6 years ago by ARolek

auto trim whitespaceFrozenDueToAgeProposal

#20879 opened 6 years ago by carl-mastrangelo

template.HTML being escaped (rather than included verbatim) sometimesFrozenDueToAgeNeedsFixrelease-blocker

#20842 opened 6 years ago by dmitshur

clarify, perhaps expand allowed URLs in urlFilter FrozenDueToAgeNeedsFix

#20586 opened 6 years ago by erikformella

recognize text/babel as synonym for text/javascriptFrozenDueToAgeNeedsFix

#20561 opened 6 years ago by jmesyan

base64 html images in image tag are unsafeFrozenDueToAge

#20536 opened 6 years ago by azr

predefined escaper "html" disallowed in template with no "html"FrozenDueToAge

#20323 opened 7 years ago by bep

MIME types handling is not case-insensitiveFrozenDueToAgeNeedsFix

#19968 opened 7 years ago by stjj89

handling of type attribute in script element is case-sensitiveFrozenDueToAge

#19965 opened 7 years ago by stjj89

predefined escaper "html" disallowed in templateFrozenDueToAge

#19952 opened 7 years ago by bep

inserted escapers are not properly merged with predefined escapers with explicit argumentsFrozenDueToAgeNeedsInvestigation

#19353 opened 7 years ago by stjj89

merging escapers can lead to over-escapingFrozenDueToAge

#19352 opened 7 years ago by stjj89

predefined HTML escaper does not properly escape user inputFrozenDueToAge

#19345 opened 7 years ago by stjj89

user-supplied escapers can undermine contextual auto-escapingFrozenDueToAgeNeedsInvestigation

#19336 opened 7 years ago by stjj89

behaviour of HTML templates changed between 1.7.5 and 1.8FrozenDueToAgeNeedsInvestigation

#19294 opened 7 years ago by seehuhn

URL auto-escaper may produce invalid markupFrozenDueToAgeNeedsInvestigation

#19205 opened 7 years ago by moshee

Parse overrides templates with empty templatesFrozenDueToAgeNeedsInvestigation

#19204 opened 7 years ago by DDRBoxman

Multithread template parse - panic (concurrent map writes)FrozenDueToAge

#19170 opened 7 years ago by SebastianPozoga

document Funcs must be called before ParseDocumentationFrozenDueToAgeNeedsFix

#18971 opened 7 years ago by zwass

nil argument to function yields wrong number of args errorFrozenDueToAgeNeedsFix

#18716 opened 7 years ago by sethvargo

<script> tags with type "text/template" now escapes EJS templatesFrozenDueToAgeNeedsDecisionNeedsInvestigationSecurity

#18569 opened 7 years ago by anthonybishopric

Go 1.8 has a different encoding logic. Intentionally?FrozenDueToAge

#18159 opened 7 years ago by leonklingele

rewriting html/template filesFrozenDueToAgeNeedsDecision

#17933 opened 7 years ago by jmhodges

URL escapes query paramsFrozenDueToAgeNeedsDecisionNeedsInvestigation

#17894 opened 7 years ago by rudydai

"no such template" error after use of CloneFrozenDueToAgeNeedsFix

#17735 opened 7 years ago by rhysh

srcset incorrectly escapedFrozenDueToAgeNeedsFix

#17441 opened 7 years ago by okdave

Spamming errorFrozenDueToAgeNeedsFix

#17414 opened 7 years ago by bep

clarify "ambiguous URL context" messageFrozenDueToAgeNeedsFix

#17319 opened 7 years ago by bep

block inside title causes memory leakFrozenDueToAgeNeedsFix

#17019 opened 7 years ago by ghost

Security Model definition link brokenDocumentationFrozenDueToAge

#16148 opened 7 years ago by mbertschler

concurrent map read and map write in executeFrozenDueToAgeNeedsInvestigation

#16101 opened 7 years ago by bep

add helper functions for type conversionFrozenDueToAge

#16058 opened 7 years ago by localvar

stateURL context percent encodes "(", ")" yet they are valid path charactersFrozenDueToAgeNeedsFix

#15891 opened 8 years ago by gmccue

(*Template).Parse fails after an associated template has executedFrozenDueToAgeNeedsFix

#15761 opened 8 years ago by mstetson

XSS risk with external JSONFrozenDueToAgeSecurity

#15399 opened 8 years ago by neelance

ParseFiles throws away files with the same filename baseFrozenDueToAge

#14320 opened 8 years ago by bep

removes content inside html commentsFrozenDueToAge

#14256 opened 8 years ago by liggitt

suggest to add HTMLEscape for / to &#x2FFrozenDueToAge

#14033 opened 8 years ago by iamzhout

user-supplied Funcs can be overwrittenDocumentationFrozenDueToAge

#13852 opened 8 years ago by okdave

DefinedTemplates is missingFrozenDueToAge

#13349 opened 8 years ago by robpike

broken after cloneFrozenDueToAge

#12996 opened 8 years ago by jbeda

escape first char for XMLFrozenDueToAge

#12496 opened 8 years ago by alexandrestein

bad quotes in second <div>FrozenDueToAgeNeedsFix

#12149 opened 8 years ago by Miaonster

slow performance on big structuresFrozenDueToAge

#11678 opened 8 years ago by vadimyer

unidentified node type in allIdents (4)FrozenDueToAge

#11356 opened 8 years ago by dvyukov

unidentified node type in allIdents (3)FrozenDueToAge

#11118 opened 8 years ago by dvyukov

Clone an empty template leads to runtime panicFrozenDueToAge

#10879 opened 9 years ago by paradoxe

unidentified node type in allIdents (2)FrozenDueToAge

#10801 opened 9 years ago by dvyukov

slice bounds out of rangeFrozenDueToAge

#10799 opened 9 years ago by dvyukov

Calling Template.Execute with no top-level template panicsFrozenDueToAge

#10786 opened 9 years ago by anacrolix

nil pointer dereferenceFrozenDueToAge

#10673 opened 9 years ago by dvyukov

invalid memory address or nil pointer dereferenceFrozenDueToAge

#10615 opened 9 years ago by dvyukov

runtime error: slice bounds out of range (2)FrozenDueToAge

#10613 opened 9 years ago by dvyukov

runtime error: slice bounds out of rangeFrozenDueToAge

#10612 opened 9 years ago by dvyukov

escaping {{else}} is unimplementedFrozenDueToAge

#10611 opened 9 years ago by dvyukov

unidentified node type in allIdentsFrozenDueToAge

#10610 opened 9 years ago by dvyukov

escapeTemplate is inefficientFrozenDueToAge

#10605 opened 9 years ago by chowey

panic when executing invalid templateFrozenDueToAge

#10204 opened 9 years ago by jstemmer

how about add a new fucntionFrozenDueToAge

#9840 opened 9 years ago by TapirLiu

`HTML` type example is confusingFrozenDueToAge

#9651 opened 9 years ago by ssilva

Provide an example of loading a template from a file and executing it.DocumentationFrozenDueToAge

#8500 opened 9 years ago by gopherbot

ParseFiles confusion with same base nameFrozenDueToAge

#8464 opened 9 years ago by gopherbot

Unexpected panic on second execution of unescapable templateFrozenDueToAge

#8431 opened 9 years ago by gopherbot

{{value | .Method}} panics and prevents escapingFrozenDueToAge

#7379 opened 10 years ago by gopherbot

truncated output for URLFrozenDueToAgeSecurity

#6701 opened 10 years ago by robpike

t.Tree is always nilFrozenDueToAge

#6459 opened 10 years ago by gopherbot

need access to parse tree.FrozenDueToAge

#6318 opened 10 years ago by gopherbot

panic when applying template to a nil error fieldFrozenDueToAge

#5982 opened 10 years ago by josharian

Execute panics on custom function errors after CloneFrozenDueToAge

#5980 opened 10 years ago by gopherbot

"stripTags" exportability in the html/template packageFrozenDueToAge

#5884 opened 10 years ago by gopherbot

execute adds blanksFrozenDueToAge

#5534 opened 11 years ago by gopherbot

Documentation for func Must references template.MustDocumentationFrozenDueToAge

#4634 opened 11 years ago by campoy

remove noescape supportFrozenDueToAge

#3528 opened 12 years ago by rsc

cannot access html/template's embedded parse.TreeFrozenDueToAge

#3461 opened 12 years ago by lilyball

missing Templates method, Escape functionsFrozenDueToAge

#3296 opened 12 years ago by mpl

panic during CloneFrozenDueToAge

#3281 opened 12 years ago by rsc

Two panics on executing empty/missing templatesFrozenDueToAge

#3272 opened 12 years ago by dsymonds

compact HTML outputFrozenDueToAgeThinking

#3164 opened 12 years ago by balasanjay

escape xmldesc as <?xmlFrozenDueToAge

#3133 opened 12 years ago by ukai

matches DOCTYPE in a case-sensitive manner. Should be insensitive.FrozenDueToAge

#3094 opened 12 years ago by gopherbot

does not call .String method for formattingFrozenDueToAge

#3073 opened 12 years ago by the42

add Clone and AddParseTreeFrozenDueToAge

#2757 opened 12 years ago by robpike

confusing or incorrect errorFrozenDueToAge

#2644 opened 12 years ago by rsc

Funcs refers to template.FuncMap (in text/template)FrozenDueToAge

#2546 opened 12 years ago by rsc

Must is bustFrozenDueToAge

#2545 opened 12 years ago by rsc