template

package standard library

Versions in this module

go1

go1.18.10

Jan 10, 2023 GO-2023-1703GO-2023-1751GO-2023-1752GO-2023-1753GO-2023-2041GO-2023-2043GO-2024-2610GO-2026-4603GO-2026-4865GO-2026-4980GO-2026-4982GO-2026-6091

GO-2023-1703: Backticks not treated as string delimiters in html/template

GO-2023-1751: Improper sanitization of CSS values in html/template

GO-2023-1752: Improper handling of JavaScript whitespace in html/template

GO-2023-1753: Improper handling of empty HTML attributes in html/template

GO-2023-2041: Improper handling of HTML-like comments in script contexts in html/template

GO-2023-2043: Improper handling of special tags within script contexts in html/template

GO-2024-2610: Errors returned from JSON marshaling may break template escaping in html/template

GO-2026-4603: URLs in meta content attribute actions are not escaped in html/template

GO-2026-4865: JsBraceDepth Context Tracking Bugs (XSS) in html/template

GO-2026-4980: Escaper bypass leads to XSS in html/template

GO-2026-4982: Bypass of meta content URL escaping causes XSS in html/template

GO-2026-6091: Fix Javascript regexp context tracking in html/template

Changes in this version

+ func HTMLEscape(w io.Writer, b []byte)

+ func HTMLEscapeString(s string) string

+ func HTMLEscaper(args ...any) string

+ func IsTrue(val any) (truth, ok bool)

+ func JSEscape(w io.Writer, b []byte)

+ func JSEscapeString(s string) string

+ func JSEscaper(args ...any) string

+ func URLQueryEscaper(args ...any) string

+ type CSS string

+ type Error struct

+ Description string

+ ErrorCode ErrorCode

+ Line int

+ Name string

+ Node parse.Node

+ func (e *Error) Error() string

+ type ErrorCode int

+ const ErrAmbigContext

+ const ErrBadHTML

+ const ErrBranchEnd

+ const ErrEndContext

+ const ErrNoSuchTemplate

+ const ErrOutputContext

+ const ErrPartialCharset

+ const ErrPartialEscape

+ const ErrPredefinedEscaper

+ const ErrRangeLoopReentry

+ const ErrSlashAmbig

+ const OK

+ type FuncMap map[string]any

+ type HTML string

+ type HTMLAttr string

+ type JS string

+ type JSStr string

+ type Srcset string

+ type Template struct

+ Tree *parse.Tree

+ func Must(t *Template, err error) *Template

+ func New(name string) *Template

+ func ParseFS(fs fs.FS, patterns ...string) (*Template, error)

+ func ParseFiles(filenames ...string) (*Template, error)

+ func ParseGlob(pattern string) (*Template, error)

+ func (t *Template) AddParseTree(name string, tree *parse.Tree) (*Template, error)

+ func (t *Template) Clone() (*Template, error)

+ func (t *Template) DefinedTemplates() string

+ func (t *Template) Delims(left, right string) *Template

+ func (t *Template) Execute(wr io.Writer, data any) error

+ func (t *Template) ExecuteTemplate(wr io.Writer, name string, data any) error

+ func (t *Template) Funcs(funcMap FuncMap) *Template

+ func (t *Template) Lookup(name string) *Template

+ func (t *Template) Name() string

+ func (t *Template) New(name string) *Template

+ func (t *Template) Option(opt ...string) *Template

+ func (t *Template) Parse(text string) (*Template, error)

+ func (t *Template) ParseFS(fs fs.FS, patterns ...string) (*Template, error)

+ func (t *Template) ParseFiles(filenames ...string) (*Template, error)

+ func (t *Template) ParseGlob(pattern string) (*Template, error)

+ func (t *Template) Templates() []*Template

+ type URL string

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL