`,
181 | []string{
182 | `%3cb%3e%20%22foo%25%22%20O%27Reilly%20%26bar%3b`,
183 | `a%5bhref%20%3d~%20%22%2f%2fexample.com%22%5d%23foo`,
184 | `Hello%2c%20%3cb%3eWorld%3c%2fb%3e%20%26amp%3btc%21`,
185 | `%20dir%3d%22ltr%22`,
186 | `c%20%26%26%20alert%28%22Hello%2c%20World%21%22%29%3b`,
187 | `Hello%2c%20World%20%26%20O%27Reilly%5cx21`,
188 | // Quotes and parens are escaped but %69 is not over-escaped. HTML escaping is done.
189 | `greeting=H%69&addressee=%28World%29`,
190 | },
191 | },
192 | {
193 | ``,
194 | []string{
195 | `%3cb%3e%20%22foo%25%22%20O%27Reilly%20%26bar%3b`,
196 | `a%5bhref%20%3d~%20%22%2f%2fexample.com%22%5d%23foo`,
197 | `Hello%2c%20%3cb%3eWorld%3c%2fb%3e%20%26amp%3btc%21`,
198 | `%20dir%3d%22ltr%22`,
199 | `c%20%26%26%20alert%28%22Hello%2c%20World%21%22%29%3b`,
200 | `Hello%2c%20World%20%26%20O%27Reilly%5cx21`,
201 | // Quotes and parens are escaped but %69 is not over-escaped. HTML escaping is not done.
202 | `greeting=H%69&addressee=%28World%29`,
203 | },
204 | },
205 | }
206 |
207 | for _, test := range tests {
208 | text := fmt.Sprintf(`{{define "t"}}%s{{end}}`, test.input)
209 | tmpl, err := new(Set).Parse(text)
210 | if err != nil {
211 | t.Fatalf("failed parsing %q: %s", text, err)
212 | }
213 | tmpl.Escape()
214 | pre := strings.Index(test.input, "{{.}}")
215 | post := len(test.input) - (pre + 5)
216 | var b bytes.Buffer
217 | for i, x := range data {
218 | b.Reset()
219 | if err := tmpl.Execute(&b, "t", x); err != nil {
220 | t.Errorf("%q with %v: %s", test.input, x, err)
221 | continue
222 | }
223 | if want, got := test.want[i], b.String()[pre:b.Len()-post]; want != got {
224 | t.Errorf("%q with %v:\nwant\n\t%q,\ngot\n\t%q\n", test.input, x, want, got)
225 | continue
226 | }
227 | }
228 | }
229 | }
230 |
231 | // Test that we print using the String method. Was issue 3073.
232 | type contentStringer struct {
233 | v int
234 | }
235 |
236 | func (s *contentStringer) String() string {
237 | return fmt.Sprintf("string=%d", s.v)
238 | }
239 |
240 | type errorer struct {
241 | v int
242 | }
243 |
244 | func (s *errorer) Error() string {
245 | return fmt.Sprintf("error=%d", s.v)
246 | }
247 |
248 | func TestStringer(t *testing.T) {
249 | s := &contentStringer{3}
250 | b := new(bytes.Buffer)
251 | tmpl, err := new(Set).Parse(`{{define "t"}}{{.}}{{end}}`)
252 | if err != nil {
253 | t.Fatalf("failed parsing: %s", err)
254 | }
255 | tmpl.Escape()
256 | if err := tmpl.Execute(b, "t", s); err != nil {
257 | t.Fatal(err)
258 | }
259 | var expect = "string=3"
260 | if b.String() != expect {
261 | t.Errorf("expected %q got %q", expect, b.String())
262 | }
263 | e := &errorer{7}
264 | b.Reset()
265 | if err := tmpl.Execute(b, "t", e); err != nil {
266 | t.Fatal(err)
267 | }
268 | expect = "error=7"
269 | if b.String() != expect {
270 | t.Errorf("expected %q got %q", expect, b.String())
271 | }
272 | }
273 |
--------------------------------------------------------------------------------
/v0/template.go:
--------------------------------------------------------------------------------
1 | // Copyright 2011 The Go Authors. All rights reserved.
2 | // Use of this source code is governed by a BSD-style
3 | // license that can be found in the LICENSE file.
4 |
5 | package template
6 |
7 | import (
8 | "fmt"
9 | "io/ioutil"
10 | "path/filepath"
11 | "reflect"
12 | "sync"
13 |
14 | "github.com/gorilla/template/v0/escape"
15 | "github.com/gorilla/template/v0/parse"
16 | )
17 |
18 | // Set stores a collection of parsed templates.
19 | //
20 | // To add templates call Set.Parse (or other parse methods):
21 | //
22 | // set, err := new(Set).Parse(`{{define "hello"}}Hello, World.{{end}}`)
23 | // if err != nil {
24 | // // do something with the parsing error...
25 | // }
26 | //
27 | // To execute a template call Set.Execute passing an io.Writer, the name of
28 | // the template to execute and related data:
29 | //
30 | // err = set.Execute(os.Stderr, "hello", nil)
31 | // if err != nil {
32 | // // do something with the execution error...
33 | // }
34 | type Set struct {
35 | mutex sync.Mutex
36 | tree parse.Tree
37 | leftDelim string
38 | rightDelim string
39 | escape bool // compilation flag to perform contextual escaping
40 | compiled bool // compilation flag to lock the set after first execution
41 | // We use two maps, one for parsing and one for execution.
42 | parseFuncs FuncMap
43 | execFuncs map[string]reflect.Value
44 | }
45 |
46 | // init initializes the set fields to default values.
47 | func (s *Set) init() {
48 | if s.tree == nil {
49 | s.tree = make(parse.Tree)
50 | }
51 | if s.execFuncs == nil {
52 | s.execFuncs = make(map[string]reflect.Value)
53 | }
54 | if s.parseFuncs == nil {
55 | s.parseFuncs = make(FuncMap)
56 | }
57 | }
58 |
59 | // Delims sets the action delimiters to the specified strings, to be used in
60 | // subsequent calls to Parse. An empty delimiter stands for the corresponding
61 | // default: "{{" or "}}".
62 | // The return value is the set, so calls can be chained.
63 | func (s *Set) Delims(left, right string) *Set {
64 | s.leftDelim = left
65 | s.rightDelim = right
66 | return s
67 | }
68 |
69 | // Funcs adds the elements of the argument map to the template's function map.
70 | // It panics if a value in the map is not a function with appropriate return
71 | // type. However, it is legal to overwrite elements of the map. The return
72 | // value is the set, so calls can be chained.
73 | func (s *Set) Funcs(funcMap FuncMap) *Set {
74 | s.init()
75 | addValueFuncs(s.execFuncs, funcMap)
76 | addFuncs(s.parseFuncs, funcMap)
77 | return s
78 | }
79 |
80 | // Escape turns on contextual escaping in all templates in the set, rewriting
81 | // them to guarantee that the output is safe. The return value is the set,
82 | // so calls can be chained.
83 | func (s *Set) Escape() *Set {
84 | s.escape = true
85 | return s
86 | }
87 |
88 | // Clone returns a duplicate of the template, including all associated
89 | // templates. The actual representation is not copied, but the name space of
90 | // associated templates is, so further calls to Parse in the copy will add
91 | // templates to the copy but not to the original. Clone can be used to prepare
92 | // common templates and use them with variant definitions for other templates
93 | // by adding the variants after the clone is made.
94 | func (s *Set) Clone() (*Set, error) {
95 | s.mutex.Lock()
96 | defer s.mutex.Unlock()
97 | ns := new(Set).Delims(s.leftDelim, s.rightDelim)
98 | ns.init()
99 | for k, v := range s.parseFuncs {
100 | ns.parseFuncs[k] = v
101 | }
102 | for k, v := range s.execFuncs {
103 | ns.execFuncs[k] = v
104 | }
105 | err := ns.tree.AddTree(s.tree.Copy())
106 | if err != nil {
107 | return nil, err
108 | }
109 | ns.escape = s.escape
110 | ns.compiled = s.compiled
111 | return ns, nil
112 | }
113 |
114 | // Compile performs inlining and contextual escaping in all templates in the
115 | // set. This doesn't need to be called manually because the set is compiled
116 | // automatically when executed, but it can be used to force compilation and
117 | // catch errors earlier.
118 | func (s *Set) Compile() (*Set, error) {
119 | s.mutex.Lock()
120 | defer s.mutex.Unlock()
121 | if !s.compiled {
122 | // Inlining.
123 | if err := inlineTree(s.tree); err != nil {
124 | return nil, err
125 | }
126 | // Contextual escaping.
127 | if s.escape {
128 | if err := escape.EscapeTree(s.tree); err != nil {
129 | return nil, err
130 | }
131 | s.Funcs(escape.FuncMap)
132 | }
133 | s.compiled = true
134 | }
135 | return s, nil
136 | }
137 |
138 | // Parse ----------------------------------------------------------------------
139 |
140 | // parse parses the given text and adds the resulting templates to the set.
141 | // The name is only used for debugging purposes: when parsing files or glob,
142 | // it can show which file caused an error.
143 | //
144 | // Parsing templates after the set executed results in an error.
145 | func (s *Set) parse(text, name string) (*Set, error) {
146 | s.mutex.Lock()
147 | defer s.mutex.Unlock()
148 | if s.compiled {
149 | return nil, fmt.Errorf(
150 | "template: new templates can't be added after execution")
151 | }
152 | s.init()
153 | if tree, err := parse.Parse(name, text, s.leftDelim, s.rightDelim,
154 | builtins, s.parseFuncs); err != nil {
155 | return nil, err
156 | } else if err = s.tree.AddTree(tree); err != nil {
157 | return nil, err
158 | }
159 | return s, nil
160 | }
161 |
162 | // Parse parses the given text and adds the resulting templates to the set.
163 | // If an error occurs, parsing stops and the returned set is nil; otherwise
164 | // it is s.
165 | func (s *Set) Parse(text string) (*Set, error) {
166 | return s.parse(text, "template string")
167 | }
168 |
169 | // ParseFiles parses the named files and adds the resulting templates to the
170 | // set. There must be at least one file. If an error occurs, parsing stops and
171 | // the returned set is nil; otherwise it is s.
172 | func (s *Set) ParseFiles(filenames ...string) (*Set, error) {
173 | if len(filenames) == 0 {
174 | // Not really a problem, but be consistent.
175 | return nil, fmt.Errorf(
176 | "template: ParseFiles must be called with at least one filename")
177 | }
178 | for _, filename := range filenames {
179 | if b, err := ioutil.ReadFile(filename); err != nil {
180 | return nil, err
181 | } else if _, err = s.parse(string(b), filename); err != nil {
182 | return nil, err
183 | }
184 | }
185 | return s, nil
186 | }
187 |
188 | // ParseGlob parses the template definitions in the files identified by the
189 | // pattern and adds the resulting templates to the set. The pattern is
190 | // processed by filepath.Glob and must match at least one file. ParseGlob is
191 | // equivalent to calling s.ParseFiles with the list of files matched by the
192 | // pattern. If an error occurs, parsing stops and the returned set is nil;
193 | // otherwise it is s.
194 | func (s *Set) ParseGlob(pattern string) (*Set, error) {
195 | filenames, err := filepath.Glob(pattern)
196 | if err != nil {
197 | return nil, err
198 | }
199 | if len(filenames) == 0 {
200 | return nil, fmt.Errorf(
201 | "template: pattern doesn't match any files: %#q", pattern)
202 | }
203 | return s.ParseFiles(filenames...)
204 | }
205 |
206 | // Convenience parsing wrappers -----------------------------------------------
207 |
208 | // Must is a helper that wraps a call to a function that returns (*Set, error)
209 | // and panics if the error is non-nil. It is intended for use in variable
210 | // initializations such as:
211 | //
212 | // var set = Must(new(Set).Parse(`{{define "hello"}}Hello, World.{{end}}`))
213 | func Must(s *Set, err error) *Set {
214 | if err != nil {
215 | panic(err)
216 | }
217 | return s
218 | }
219 |
220 | // This redundant API is probably not needed...
221 |
222 | // Parse creates a new Set with the template definitions from the given text.
223 | // If an error occurs, parsing stops and the returned set is nil.
224 | //func Parse(text string) (*Set, error) {
225 | // return new(Set).Parse(text)
226 | //}
227 |
228 | // ParseFiles creates a new Set with the template definitions from the named
229 | // files. There must be at least one file. If an error occurs, parsing stops
230 | // and the returned set is nil.
231 | //func ParseFiles(filenames ...string) (*Set, error) {
232 | // return new(Set).ParseFiles(filenames...)
233 | //}
234 |
235 | // ParseGlob creates a new Set with the template definitions from the
236 | // files identified by the pattern. The pattern is processed by filepath.Glob
237 | // and must match at least one file. ParseGlob is equivalent to calling
238 | // ParseFiles with the list of files matched by the pattern. If an error
239 | // occurs, parsing stops and the returned set is nil.
240 | //func ParseGlob(pattern string) (*Set, error) {
241 | // return new(Set).ParseGlob(pattern)
242 | //}
243 |
--------------------------------------------------------------------------------
/v0/escape/context.go:
--------------------------------------------------------------------------------
1 | // Copyright 2011 The Go Authors. All rights reserved.
2 | // Use of this source code is governed by a BSD-style
3 | // license that can be found in the LICENSE file.
4 |
5 | package escape
6 |
7 | import (
8 | "fmt"
9 | )
10 |
11 | // context describes the state an HTML parser must be in when it reaches the
12 | // portion of HTML produced by evaluating a particular template node.
13 | //
14 | // The zero value of type context is the start context for a template that
15 | // produces an HTML fragment as defined at
16 | // http://www.w3.org/TR/html5/the-end.html#parsing-html-fragments
17 | // where the context element is null.
18 | type context struct {
19 | state state
20 | delim delim
21 | urlPart urlPart
22 | jsCtx jsCtx
23 | attr attr
24 | element element
25 | err *Error
26 | }
27 |
28 | func (c context) String() string {
29 | return fmt.Sprintf("{%v %v %v %v %v %v %v}", c.state, c.delim, c.urlPart, c.jsCtx, c.attr, c.element, c.err)
30 | }
31 |
32 | // eq returns whether two contexts are equal.
33 | func (c context) eq(d context) bool {
34 | return c.state == d.state &&
35 | c.delim == d.delim &&
36 | c.urlPart == d.urlPart &&
37 | c.jsCtx == d.jsCtx &&
38 | c.attr == d.attr &&
39 | c.element == d.element &&
40 | c.err == d.err
41 | }
42 |
43 | // mangle produces an identifier that includes a suffix that distinguishes it
44 | // from template names mangled with different contexts.
45 | func (c context) mangle(templateName string) string {
46 | // The mangled name for the default context is the input templateName.
47 | if c.state == stateText {
48 | return templateName
49 | }
50 | s := templateName + "$htmltemplate_" + c.state.String()
51 | if c.delim != 0 {
52 | s += "_" + c.delim.String()
53 | }
54 | if c.urlPart != 0 {
55 | s += "_" + c.urlPart.String()
56 | }
57 | if c.jsCtx != 0 {
58 | s += "_" + c.jsCtx.String()
59 | }
60 | if c.attr != 0 {
61 | s += "_" + c.attr.String()
62 | }
63 | if c.element != 0 {
64 | s += "_" + c.element.String()
65 | }
66 | return s
67 | }
68 |
69 | // state describes a high-level HTML parser state.
70 | //
71 | // It bounds the top of the element stack, and by extension the HTML insertion
72 | // mode, but also contains state that does not correspond to anything in the
73 | // HTML5 parsing algorithm because a single token production in the HTML
74 | // grammar may contain embedded actions in a template. For instance, the quoted
75 | // HTML attribute produced by
76 | //
77 | // is a single token in HTML's grammar but in a template spans several nodes.
78 | type state uint8
79 |
80 | const (
81 | // stateText is parsed character data. An HTML parser is in
82 | // this state when its parse position is outside an HTML tag,
83 | // directive, comment, and special element body.
84 | stateText state = iota
85 | // stateTag occurs before an HTML attribute or the end of a tag.
86 | stateTag
87 | // stateAttrName occurs inside an attribute name.
88 | // It occurs between the ^'s in ` ^name^ = value`.
89 | stateAttrName
90 | // stateAfterName occurs after an attr name has ended but before any
91 | // equals sign. It occurs between the ^'s in ` name^ ^= value`.
92 | stateAfterName
93 | // stateBeforeValue occurs after the equals sign but before the value.
94 | // It occurs between the ^'s in ` name =^ ^value`.
95 | stateBeforeValue
96 | // stateHTMLCmt occurs inside an .
97 | stateHTMLCmt
98 | // stateRCDATA occurs inside an RCDATA element (`,
413 | context{state: stateText},
414 | },
415 | {
416 | `