├── .codeclimate.yml
├── .github
    └── workflows
    │   ├── ci.yaml
    │   └── lint.yaml
├── .golangci.yaml
├── LICENSE
├── PATENTS
├── README.md
├── go.mod
├── strip.go
└── strip_test.go


/.codeclimate.yml:
--------------------------------------------------------------------------------
 1 | engines:
 2 |   gofmt:
 3 |     enabled: true
 4 |   golint:
 5 |     enabled: true
 6 |   govet:
 7 |     enabled: true
 8 | 
 9 | ratings:
10 |   paths:
11 |     - "**.go"
12 | 


--------------------------------------------------------------------------------
/.github/workflows/ci.yaml:
--------------------------------------------------------------------------------
 1 | name: CI
 2 | on:
 3 |   push:
 4 |     branches:
 5 |       - master
 6 |   pull_request:
 7 |     branches:
 8 |       - master
 9 |   workflow_dispatch:
10 | jobs:
11 |   test:
12 |     strategy:
13 |       matrix:
14 |         go-version: [1.24.x, 1.16.x]
15 |         platform: [ubuntu-latest, macos-latest, windows-latest]
16 |     runs-on: ${{ matrix.platform }}
17 |     steps:
18 |     - name: Install Go
19 |       if: success()
20 |       uses: actions/setup-go@v2
21 |       with:
22 |         go-version: ${{ matrix.go-version }}
23 |     - name: Checkout code
24 |       uses: actions/checkout@v3
25 |     - name: Run tests
26 |       run: go test -v -covermode=count ./...
27 | 


--------------------------------------------------------------------------------
/.github/workflows/lint.yaml:
--------------------------------------------------------------------------------
 1 | name: lint
 2 | on:
 3 |   workflow_dispatch:
 4 | jobs:
 5 |   lint:
 6 |     strategy:
 7 |       matrix:
 8 |         go-version: [1.x]
 9 |         platform: [ubuntu-latest]
10 |     runs-on: ${{ matrix.platform }}
11 |     steps:
12 |     - uses: actions/checkout@v4
13 |     - name: golangci-lint
14 |       uses: golangci/golangci-lint-action@v3
15 |       with:
16 |         version: latest
17 |         args: --timeout 3m --verbose
18 | 


--------------------------------------------------------------------------------
/.golangci.yaml:
--------------------------------------------------------------------------------
 1 | linters:
 2 |   enable:
 3 |     - dogsled
 4 |     - dupl
 5 |     - gofmt
 6 |     - goimports
 7 |     - gosec
 8 |     - misspell
 9 |     - nakedret
10 |     - stylecheck
11 |     - unconvert
12 |     - unparam
13 |     - whitespace
14 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | Copyright (c) 2009 The Go Authors. All rights reserved.
 2 | 
 3 | Redistribution and use in source and binary forms, with or without
 4 | modification, are permitted provided that the following conditions are
 5 | met:
 6 | 
 7 |    * Redistributions of source code must retain the above copyright
 8 | notice, this list of conditions and the following disclaimer.
 9 |    * Redistributions in binary form must reproduce the above
10 | copyright notice, this list of conditions and the following disclaimer
11 | in the documentation and/or other materials provided with the
12 | distribution.
13 |    * Neither the name of Google Inc. nor the names of its
14 | contributors may be used to endorse or promote products derived from
15 | this software without specific prior written permission.
16 | 
17 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 | "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 | LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
20 | A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
21 | OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
22 | SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
23 | LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 | DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 | THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 | (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
27 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 | 


--------------------------------------------------------------------------------
/PATENTS:
--------------------------------------------------------------------------------
 1 | Additional IP Rights Grant (Patents)
 2 | 
 3 | "This implementation" means the copyrightable works distributed by
 4 | Google as part of the Go project.
 5 | 
 6 | Google hereby grants to You a perpetual, worldwide, non-exclusive,
 7 | no-charge, royalty-free, irrevocable (except as stated in this section)
 8 | patent license to make, have made, use, offer to sell, sell, import,
 9 | transfer and otherwise run, modify and propagate the contents of this
10 | implementation of Go, where such license applies only to those patent
11 | claims, both currently owned or controlled by Google and acquired in
12 | the future, licensable by Google that are necessarily infringed by this
13 | implementation of Go.  This grant does not include claims that would be
14 | infringed only as a consequence of further modification of this
15 | implementation.  If you or your agent or exclusive licensee institute or
16 | order or agree to the institution of patent litigation against any
17 | entity (including a cross-claim or counterclaim in a lawsuit) alleging
18 | that this implementation of Go or any code incorporated within this
19 | implementation of Go constitutes direct or contributory patent
20 | infringement, or inducement of patent infringement, then any patent
21 | rights granted to you under this License for this implementation of Go
22 | shall terminate as of the date such litigation is filed.
23 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | HTML StripTags for Go
 2 | =====================
 3 | 
 4 | [![Used By][used-by-svg]][used-by-url]
 5 | [![Build Status][build-status-svg]][build-status-url]
 6 | [![Go Report Card][goreport-svg]][goreport-url]
 7 | [![Docs][docs-godoc-svg]][docs-godoc-url]
 8 | [![License][license-svg]][license-url]
 9 | 
10 | This is a Go package containing an extracted version of the unexported `stripTags` function in `html/template/html.go`.
11 | 
12 | :warning: This package does not protect against untrusted input. Please use [bluemonday](https://github.com/microcosm-cc/bluemonday) if you have untrusted data :warning:
13 | 
14 | ## Background
15 | 
16 | * The `stripTags` function in `html/template/html.go` is very useful, however, it is not exported.
17 | * Requests were made [on GitHub](https://github.com/golang/go/issues/5884) without success.
18 | * This package is a repo for work done by [Christopher Hesse](https://github.com/christopherhesse) provided in this [Gist](https://gist.github.com/christopherhesse/d422447a086d373a967f).
19 | 
20 | ## Installation
21 | 
22 | ```bash
23 | $ go get github.com/grokify/html-strip-tags-go
24 | ```
25 | 
26 | ## Usage
27 | 
28 | ```go
29 | import(
30 |     "github.com/grokify/html-strip-tags-go" // => strip
31 | )
32 | 
33 | func main() {
34 |     original := "<h1>Hello World</h1>"
35 |     stripped := strip.StripTags(original) // => "Hello World"
36 | }
37 | ```
38 | 
39 |  [used-by-svg]: https://sourcegraph.com/github.com/grokify/html-strip-tags-go/-/badge.svg
40 |  [used-by-url]: https://sourcegraph.com/github.com/grokify/html-strip-tags-go?badge
41 |  [goreport-svg]: https://goreportcard.com/badge/github.com/grokify/html-strip-tags-go
42 |  [goreport-url]: https://goreportcard.com/report/github.com/grokify/html-strip-tags-go
43 |  [build-status-svg]: https://github.com/grokify/html-strip-tags-go/actions/workflows/ci.yaml/badge.svg?branch=main
44 |  [build-status-url]: https://github.com/grokify/html-strip-tags-go/actions/workflows/ci.yaml
45 |  [coverage-status-svg]: https://coveralls.io/repos/grokify/html-strip-tags-go/badge.svg?branch=master
46 |  [coverage-status-url]: https://coveralls.io/r/grokify/html-strip-tags-go?branch=master
47 |  [codeclimate-status-svg]: https://codeclimate.com/github/grokify/html-strip-tags-go/badges/gpa.svg
48 |  [codeclimate-status-url]: https://codeclimate.com/github/grokify/html-strip-tags-go
49 |  [docs-godoc-svg]: https://pkg.go.dev/badge/github.com/grokify/html-strip-tags-go
50 |  [docs-godoc-url]: https://pkg.go.dev/github.com/grokify/html-strip-tags-go
51 |  [license-svg]: https://img.shields.io/badge/license-BSD--style+patent--grant-blue.svg
52 |  [license-url]: https://github.com/grokify/html-strip-tags-go/blob/master/LICENSE
53 | 


--------------------------------------------------------------------------------
/go.mod:
--------------------------------------------------------------------------------
1 | module github.com/grokify/html-strip-tags-go
2 | 
3 | go 1.16
4 | 


--------------------------------------------------------------------------------
/strip.go:
--------------------------------------------------------------------------------
   1 | // Copyright 2011 The Go Authors. All rights reserved.
   2 | // Use of this source code is governed by a BSD-style
   3 | // license that can be found in the LICENSE file.
   4 | 
   5 | package strip
   6 | 
   7 | import (
   8 | 	"bytes"
   9 | 	"encoding/json"
  10 | 	"fmt"
  11 | 	"html"
  12 | 	"io"
  13 | 	"os"
  14 | 	"path/filepath"
  15 | 	"reflect"
  16 | 	"strings"
  17 | 	"sync"
  18 | 	"text/template"
  19 | 	"text/template/parse"
  20 | 	"unicode"
  21 | 	"unicode/utf8"
  22 | )
  23 | 
  24 | // htmlNospaceEscaper escapes for inclusion in unquoted attribute values.
  25 | func htmlNospaceEscaper(args ...interface{}) string {
  26 | 	s, t := stringify(args...)
  27 | 	if t == contentTypeHTML {
  28 | 		return htmlReplacer(StripTags(s), htmlNospaceNormReplacementTable, false)
  29 | 	}
  30 | 	return htmlReplacer(s, htmlNospaceReplacementTable, false)
  31 | }
  32 | 
  33 | // attrEscaper escapes for inclusion in quoted attribute values.
  34 | func attrEscaper(args ...interface{}) string {
  35 | 	s, t := stringify(args...)
  36 | 	if t == contentTypeHTML {
  37 | 		return htmlReplacer(StripTags(s), htmlNormReplacementTable, true)
  38 | 	}
  39 | 	return htmlReplacer(s, htmlReplacementTable, true)
  40 | }
  41 | 
  42 | // rcdataEscaper escapes for inclusion in an RCDATA element body.
  43 | func rcdataEscaper(args ...interface{}) string {
  44 | 	s, t := stringify(args...)
  45 | 	if t == contentTypeHTML {
  46 | 		return htmlReplacer(s, htmlNormReplacementTable, true)
  47 | 	}
  48 | 	return htmlReplacer(s, htmlReplacementTable, true)
  49 | }
  50 | 
  51 | // htmlEscaper escapes for inclusion in HTML text.
  52 | func htmlEscaper(args ...interface{}) string {
  53 | 	s, t := stringify(args...)
  54 | 	if t == contentTypeHTML {
  55 | 		return s
  56 | 	}
  57 | 	return htmlReplacer(s, htmlReplacementTable, true)
  58 | }
  59 | 
  60 | // htmlReplacementTable contains the runes that need to be escaped
  61 | // inside a quoted attribute value or in a text node.
  62 | var htmlReplacementTable = []string{
  63 | 	// http://www.w3.org/TR/html5/syntax.html#attribute-value-(unquoted)-state
  64 | 	// U+0000 NULL Parse error. Append a U+FFFD REPLACEMENT
  65 | 	// CHARACTER character to the current attribute's value.
  66 | 	// "
  67 | 	// and similarly
  68 | 	// http://www.w3.org/TR/html5/syntax.html#before-attribute-value-state
  69 | 	0:    "\uFFFD",
  70 | 	'"':  "&#34;",
  71 | 	'&':  "&amp;",
  72 | 	'\'': "&#39;",
  73 | 	'+':  "&#43;",
  74 | 	'<':  "&lt;",
  75 | 	'>':  "&gt;",
  76 | }
  77 | 
  78 | // htmlNormReplacementTable is like htmlReplacementTable but without '&' to
  79 | // avoid over-encoding existing entities.
  80 | var htmlNormReplacementTable = []string{
  81 | 	0:    "\uFFFD",
  82 | 	'"':  "&#34;",
  83 | 	'\'': "&#39;",
  84 | 	'+':  "&#43;",
  85 | 	'<':  "&lt;",
  86 | 	'>':  "&gt;",
  87 | }
  88 | 
  89 | // htmlNospaceReplacementTable contains the runes that need to be escaped
  90 | // inside an unquoted attribute value.
  91 | // The set of runes escaped is the union of the HTML specials and
  92 | // those determined by running the JS below in browsers:
  93 | // <div id=d></div>
  94 | // <script>(function () {
  95 | // var a = [], d = document.getElementById("d"), i, c, s;
  96 | //
  97 | //	for (i = 0; i < 0x10000; ++i) {
  98 | //	  c = String.fromCharCode(i);
  99 | //	  d.innerHTML = "<span title=" + c + "lt" + c + "></span>"
 100 | //	  s = d.getElementsByTagName("SPAN")[0];
 101 | //	  if (!s || s.title !== c + "lt" + c) { a.push(i.toString(16)); }
 102 | //	}
 103 | //
 104 | // document.write(a.join(", "));
 105 | // })()</script>
 106 | var htmlNospaceReplacementTable = []string{
 107 | 	0:    "&#xfffd;",
 108 | 	'\t': "&#9;",
 109 | 	'\n': "&#10;",
 110 | 	'\v': "&#11;",
 111 | 	'\f': "&#12;",
 112 | 	'\r': "&#13;",
 113 | 	' ':  "&#32;",
 114 | 	'"':  "&#34;",
 115 | 	'&':  "&amp;",
 116 | 	'\'': "&#39;",
 117 | 	'+':  "&#43;",
 118 | 	'<':  "&lt;",
 119 | 	'=':  "&#61;",
 120 | 	'>':  "&gt;",
 121 | 	// A parse error in the attribute value (unquoted) and
 122 | 	// before attribute value states.
 123 | 	// Treated as a quoting character by IE.
 124 | 	'`': "&#96;",
 125 | }
 126 | 
 127 | // htmlNospaceNormReplacementTable is like htmlNospaceReplacementTable but
 128 | // without '&' to avoid over-encoding existing entities.
 129 | var htmlNospaceNormReplacementTable = []string{
 130 | 	0:    "&#xfffd;",
 131 | 	'\t': "&#9;",
 132 | 	'\n': "&#10;",
 133 | 	'\v': "&#11;",
 134 | 	'\f': "&#12;",
 135 | 	'\r': "&#13;",
 136 | 	' ':  "&#32;",
 137 | 	'"':  "&#34;",
 138 | 	'\'': "&#39;",
 139 | 	'+':  "&#43;",
 140 | 	'<':  "&lt;",
 141 | 	'=':  "&#61;",
 142 | 	'>':  "&gt;",
 143 | 	// A parse error in the attribute value (unquoted) and
 144 | 	// before attribute value states.
 145 | 	// Treated as a quoting character by IE.
 146 | 	'`': "&#96;",
 147 | }
 148 | 
 149 | // htmlReplacer returns s with runes replaced according to replacementTable
 150 | // and when badRunes is true, certain bad runes are allowed through unescaped.
 151 | func htmlReplacer(s string, replacementTable []string, badRunes bool) string {
 152 | 	written, b := 0, new(bytes.Buffer)
 153 | 	for i, r := range s {
 154 | 		if int(r) < len(replacementTable) {
 155 | 			if repl := replacementTable[r]; len(repl) != 0 {
 156 | 				b.WriteString(s[written:i])
 157 | 				b.WriteString(repl)
 158 | 				// Valid as long as replacementTable doesn't
 159 | 				// include anything above 0x7f.
 160 | 				written = i + utf8.RuneLen(r)
 161 | 			}
 162 | 		} else if badRunes {
 163 | 			// No-op.
 164 | 			// IE does not allow these ranges in unquoted attrs.
 165 | 		} else if 0xfdd0 <= r && r <= 0xfdef || 0xfff0 <= r && r <= 0xffff {
 166 | 			fmt.Fprintf(b, "%s&#x%x;", s[written:i], r)
 167 | 			written = i + utf8.RuneLen(r)
 168 | 		}
 169 | 	}
 170 | 	if written == 0 {
 171 | 		return s
 172 | 	}
 173 | 	b.WriteString(s[written:])
 174 | 	return b.String()
 175 | }
 176 | 
 177 | // stripTags takes a snippet of HTML and returns only the text content.
 178 | // For example, `<b>&iexcl;Hi!</b> <script>...</script>` -> `&iexcl;Hi! `.
 179 | func StripTags(html string) string {
 180 | 	var b bytes.Buffer
 181 | 	s, c, i, allText := []byte(html), context{}, 0, true
 182 | 	// Using the transition funcs helps us avoid mangling
 183 | 	// `<div title="1>2">` or `I <3 Ponies!`.
 184 | 	for i != len(s) {
 185 | 		if c.delim == delimNone {
 186 | 			st := c.state
 187 | 			// Use RCDATA instead of parsing into JS or CSS styles.
 188 | 			if c.element != elementNone && !isInTag(st) {
 189 | 				st = stateRCDATA
 190 | 			}
 191 | 			d, nread := transitionFunc[st](c, s[i:])
 192 | 			i1 := i + nread
 193 | 			if c.state == stateText || c.state == stateRCDATA {
 194 | 				// Emit text up to the start of the tag or comment.
 195 | 				j := i1
 196 | 				if d.state != c.state {
 197 | 					for j1 := j - 1; j1 >= i; j1-- {
 198 | 						if s[j1] == '<' {
 199 | 							j = j1
 200 | 							break
 201 | 						}
 202 | 					}
 203 | 				}
 204 | 				b.Write(s[i:j])
 205 | 			} else {
 206 | 				allText = false
 207 | 			}
 208 | 			c, i = d, i1
 209 | 			continue
 210 | 		}
 211 | 		i1 := i + bytes.IndexAny(s[i:], delimEnds[c.delim])
 212 | 		if i1 < i {
 213 | 			break
 214 | 		}
 215 | 		if c.delim != delimSpaceOrTagEnd {
 216 | 			// Consume any quote.
 217 | 			i1++
 218 | 		}
 219 | 		c, i = context{state: stateTag, element: c.element}, i1
 220 | 	}
 221 | 	if allText {
 222 | 		return html
 223 | 	} else if c.state == stateText || c.state == stateRCDATA {
 224 | 		b.Write(s[i:])
 225 | 	}
 226 | 	return b.String()
 227 | }
 228 | 
 229 | // htmlNameFilter accepts valid parts of an HTML attribute or tag name or
 230 | // a known-safe HTML attribute.
 231 | func htmlNameFilter(args ...interface{}) string {
 232 | 	s, t := stringify(args...)
 233 | 	if t == contentTypeHTMLAttr {
 234 | 		return s
 235 | 	}
 236 | 	if len(s) == 0 {
 237 | 		// Avoid violation of structure preservation.
 238 | 		// <input checked {{.K}}={{.V}}>.
 239 | 		// Without this, if .K is empty then .V is the value of
 240 | 		// checked, but otherwise .V is the value of the attribute
 241 | 		// named .K.
 242 | 		return filterFailsafe
 243 | 	}
 244 | 	s = strings.ToLower(s)
 245 | 	if t := attrType(s); t != contentTypePlain {
 246 | 		// TODO: Split attr and element name part filters so we can whitelist
 247 | 		// attributes.
 248 | 		return filterFailsafe
 249 | 	}
 250 | 	for _, r := range s {
 251 | 		switch {
 252 | 		case '0' <= r && r <= '9':
 253 | 		case 'a' <= r && r <= 'z':
 254 | 		default:
 255 | 			return filterFailsafe
 256 | 		}
 257 | 	}
 258 | 	return s
 259 | }
 260 | 
 261 | // commentEscaper returns the empty string regardless of input.
 262 | // Comment content does not correspond to any parsed structure or
 263 | // human-readable content, so the simplest and most secure policy is to drop
 264 | // content interpolated into comments.
 265 | // This approach is equally valid whether or not static comment content is
 266 | // removed from the template.
 267 | func commentEscaper(args ...interface{}) string {
 268 | 	return ""
 269 | }
 270 | 
 271 | // Copyright 2011 The Go Authors. All rights reserved.
 272 | // Use of this source code is governed by a BSD-style
 273 | // license that can be found in the LICENSE file.
 274 | 
 275 | // context describes the state an HTML parser must be in when it reaches the
 276 | // portion of HTML produced by evaluating a particular template node.
 277 | //
 278 | // The zero value of type context is the start context for a template that
 279 | // produces an HTML fragment as defined at
 280 | // http://www.w3.org/TR/html5/syntax.html#the-end
 281 | // where the context element is null.
 282 | type context struct {
 283 | 	state   state
 284 | 	delim   delim
 285 | 	urlPart urlPart
 286 | 	jsCtx   jsCtx
 287 | 	attr    attr
 288 | 	element element
 289 | 	err     *Error
 290 | }
 291 | 
 292 | func (c context) String() string {
 293 | 	return fmt.Sprintf("{%v %v %v %v %v %v %v}", c.state, c.delim, c.urlPart, c.jsCtx, c.attr, c.element, c.err)
 294 | }
 295 | 
 296 | // eq reports whether two contexts are equal.
 297 | func (c context) eq(d context) bool {
 298 | 	return c.state == d.state &&
 299 | 		c.delim == d.delim &&
 300 | 		c.urlPart == d.urlPart &&
 301 | 		c.jsCtx == d.jsCtx &&
 302 | 		c.attr == d.attr &&
 303 | 		c.element == d.element &&
 304 | 		c.err == d.err
 305 | }
 306 | 
 307 | // mangle produces an identifier that includes a suffix that distinguishes it
 308 | // from template names mangled with different contexts.
 309 | func (c context) mangle(templateName string) string {
 310 | 	// The mangled name for the default context is the input templateName.
 311 | 	if c.state == stateText {
 312 | 		return templateName
 313 | 	}
 314 | 	s := templateName + "$htmltemplate_" + c.state.String()
 315 | 	if c.delim != 0 {
 316 | 		s += "_" + c.delim.String()
 317 | 	}
 318 | 	if c.urlPart != 0 {
 319 | 		s += "_" + c.urlPart.String()
 320 | 	}
 321 | 	if c.jsCtx != 0 {
 322 | 		s += "_" + c.jsCtx.String()
 323 | 	}
 324 | 	if c.attr != 0 {
 325 | 		s += "_" + c.attr.String()
 326 | 	}
 327 | 	if c.element != 0 {
 328 | 		s += "_" + c.element.String()
 329 | 	}
 330 | 	return s
 331 | }
 332 | 
 333 | // state describes a high-level HTML parser state.
 334 | //
 335 | // It bounds the top of the element stack, and by extension the HTML insertion
 336 | // mode, but also contains state that does not correspond to anything in the
 337 | // HTML5 parsing algorithm because a single token production in the HTML
 338 | // grammar may contain embedded actions in a template. For instance, the quoted
 339 | // HTML attribute produced by
 340 | //
 341 | //	<div title="Hello {{.World}}">
 342 | //
 343 | // is a single token in HTML's grammar but in a template spans several nodes.
 344 | type state uint8
 345 | 
 346 | const (
 347 | 	// stateText is parsed character data. An HTML parser is in
 348 | 	// this state when its parse position is outside an HTML tag,
 349 | 	// directive, comment, and special element body.
 350 | 	stateText state = iota
 351 | 	// stateTag occurs before an HTML attribute or the end of a tag.
 352 | 	stateTag
 353 | 	// stateAttrName occurs inside an attribute name.
 354 | 	// It occurs between the ^'s in ` ^name^ = value`.
 355 | 	stateAttrName
 356 | 	// stateAfterName occurs after an attr name has ended but before any
 357 | 	// equals sign. It occurs between the ^'s in ` name^ ^= value`.
 358 | 	stateAfterName
 359 | 	// stateBeforeValue occurs after the equals sign but before the value.
 360 | 	// It occurs between the ^'s in ` name =^ ^value`.
 361 | 	stateBeforeValue
 362 | 	// stateHTMLCmt occurs inside an <!-- HTML comment -->.
 363 | 	stateHTMLCmt
 364 | 	// stateRCDATA occurs inside an RCDATA element (<textarea> or <title>)
 365 | 	// as described at http://www.w3.org/TR/html5/syntax.html#elements-0
 366 | 	stateRCDATA
 367 | 	// stateAttr occurs inside an HTML attribute whose content is text.
 368 | 	stateAttr
 369 | 	// stateURL occurs inside an HTML attribute whose content is a URL.
 370 | 	stateURL
 371 | 	// stateJS occurs inside an event handler or script element.
 372 | 	stateJS
 373 | 	// stateJSDqStr occurs inside a JavaScript double quoted string.
 374 | 	stateJSDqStr
 375 | 	// stateJSSqStr occurs inside a JavaScript single quoted string.
 376 | 	stateJSSqStr
 377 | 	// stateJSRegexp occurs inside a JavaScript regexp literal.
 378 | 	stateJSRegexp
 379 | 	// stateJSBlockCmt occurs inside a JavaScript /* block comment */.
 380 | 	stateJSBlockCmt
 381 | 	// stateJSLineCmt occurs inside a JavaScript // line comment.
 382 | 	stateJSLineCmt
 383 | 	// stateCSS occurs inside a <style> element or style attribute.
 384 | 	stateCSS
 385 | 	// stateCSSDqStr occurs inside a CSS double quoted string.
 386 | 	stateCSSDqStr
 387 | 	// stateCSSSqStr occurs inside a CSS single quoted string.
 388 | 	stateCSSSqStr
 389 | 	// stateCSSDqURL occurs inside a CSS double quoted url("...").
 390 | 	stateCSSDqURL
 391 | 	// stateCSSSqURL occurs inside a CSS single quoted url('...').
 392 | 	stateCSSSqURL
 393 | 	// stateCSSURL occurs inside a CSS unquoted url(...).
 394 | 	stateCSSURL
 395 | 	// stateCSSBlockCmt occurs inside a CSS /* block comment */.
 396 | 	stateCSSBlockCmt
 397 | 	// stateCSSLineCmt occurs inside a CSS // line comment.
 398 | 	stateCSSLineCmt
 399 | 	// stateError is an infectious error state outside any valid
 400 | 	// HTML/CSS/JS construct.
 401 | 	stateError
 402 | )
 403 | 
 404 | var stateNames = [...]string{
 405 | 	stateText:        "stateText",
 406 | 	stateTag:         "stateTag",
 407 | 	stateAttrName:    "stateAttrName",
 408 | 	stateAfterName:   "stateAfterName",
 409 | 	stateBeforeValue: "stateBeforeValue",
 410 | 	stateHTMLCmt:     "stateHTMLCmt",
 411 | 	stateRCDATA:      "stateRCDATA",
 412 | 	stateAttr:        "stateAttr",
 413 | 	stateURL:         "stateURL",
 414 | 	stateJS:          "stateJS",
 415 | 	stateJSDqStr:     "stateJSDqStr",
 416 | 	stateJSSqStr:     "stateJSSqStr",
 417 | 	stateJSRegexp:    "stateJSRegexp",
 418 | 	stateJSBlockCmt:  "stateJSBlockCmt",
 419 | 	stateJSLineCmt:   "stateJSLineCmt",
 420 | 	stateCSS:         "stateCSS",
 421 | 	stateCSSDqStr:    "stateCSSDqStr",
 422 | 	stateCSSSqStr:    "stateCSSSqStr",
 423 | 	stateCSSDqURL:    "stateCSSDqURL",
 424 | 	stateCSSSqURL:    "stateCSSSqURL",
 425 | 	stateCSSURL:      "stateCSSURL",
 426 | 	stateCSSBlockCmt: "stateCSSBlockCmt",
 427 | 	stateCSSLineCmt:  "stateCSSLineCmt",
 428 | 	stateError:       "stateError",
 429 | }
 430 | 
 431 | func (s state) String() string {
 432 | 	if int(s) < len(stateNames) {
 433 | 		return stateNames[s]
 434 | 	}
 435 | 	return fmt.Sprintf("illegal state %d", int(s))
 436 | }
 437 | 
 438 | // isComment is true for any state that contains content meant for template
 439 | // authors & maintainers, not for end-users or machines.
 440 | func isComment(s state) bool {
 441 | 	switch s {
 442 | 	case stateHTMLCmt, stateJSBlockCmt, stateJSLineCmt, stateCSSBlockCmt, stateCSSLineCmt:
 443 | 		return true
 444 | 	}
 445 | 	return false
 446 | }
 447 | 
 448 | // isInTag return whether s occurs solely inside an HTML tag.
 449 | func isInTag(s state) bool {
 450 | 	switch s {
 451 | 	case stateTag, stateAttrName, stateAfterName, stateBeforeValue, stateAttr:
 452 | 		return true
 453 | 	}
 454 | 	return false
 455 | }
 456 | 
 457 | // delim is the delimiter that will end the current HTML attribute.
 458 | type delim uint8
 459 | 
 460 | const (
 461 | 	// delimNone occurs outside any attribute.
 462 | 	delimNone delim = iota
 463 | 	// delimDoubleQuote occurs when a double quote (") closes the attribute.
 464 | 	delimDoubleQuote
 465 | 	// delimSingleQuote occurs when a single quote (') closes the attribute.
 466 | 	delimSingleQuote
 467 | 	// delimSpaceOrTagEnd occurs when a space or right angle bracket (>)
 468 | 	// closes the attribute.
 469 | 	delimSpaceOrTagEnd
 470 | )
 471 | 
 472 | var delimNames = [...]string{
 473 | 	delimNone:          "delimNone",
 474 | 	delimDoubleQuote:   "delimDoubleQuote",
 475 | 	delimSingleQuote:   "delimSingleQuote",
 476 | 	delimSpaceOrTagEnd: "delimSpaceOrTagEnd",
 477 | }
 478 | 
 479 | func (d delim) String() string {
 480 | 	if int(d) < len(delimNames) {
 481 | 		return delimNames[d]
 482 | 	}
 483 | 	return fmt.Sprintf("illegal delim %d", int(d))
 484 | }
 485 | 
 486 | // urlPart identifies a part in an RFC 3986 hierarchical URL to allow different
 487 | // encoding strategies.
 488 | type urlPart uint8
 489 | 
 490 | const (
 491 | 	// urlPartNone occurs when not in a URL, or possibly at the start:
 492 | 	// ^ in "^http://auth/path?k=v#frag".
 493 | 	urlPartNone urlPart = iota
 494 | 	// urlPartPreQuery occurs in the scheme, authority, or path; between the
 495 | 	// ^s in "h^ttp://auth/path^?k=v#frag".
 496 | 	urlPartPreQuery
 497 | 	// urlPartQueryOrFrag occurs in the query portion between the ^s in
 498 | 	// "http://auth/path?^k=v#frag^".
 499 | 	urlPartQueryOrFrag
 500 | 	// urlPartUnknown occurs due to joining of contexts both before and
 501 | 	// after the query separator.
 502 | 	urlPartUnknown
 503 | )
 504 | 
 505 | var urlPartNames = [...]string{
 506 | 	urlPartNone:        "urlPartNone",
 507 | 	urlPartPreQuery:    "urlPartPreQuery",
 508 | 	urlPartQueryOrFrag: "urlPartQueryOrFrag",
 509 | 	urlPartUnknown:     "urlPartUnknown",
 510 | }
 511 | 
 512 | func (u urlPart) String() string {
 513 | 	if int(u) < len(urlPartNames) {
 514 | 		return urlPartNames[u]
 515 | 	}
 516 | 	return fmt.Sprintf("illegal urlPart %d", int(u))
 517 | }
 518 | 
 519 | // jsCtx determines whether a '/' starts a regular expression literal or a
 520 | // division operator.
 521 | type jsCtx uint8
 522 | 
 523 | const (
 524 | 	// jsCtxRegexp occurs where a '/' would start a regexp literal.
 525 | 	jsCtxRegexp jsCtx = iota
 526 | 	// jsCtxDivOp occurs where a '/' would start a division operator.
 527 | 	jsCtxDivOp
 528 | 	// jsCtxUnknown occurs where a '/' is ambiguous due to context joining.
 529 | 	jsCtxUnknown
 530 | )
 531 | 
 532 | func (c jsCtx) String() string {
 533 | 	switch c {
 534 | 	case jsCtxRegexp:
 535 | 		return "jsCtxRegexp"
 536 | 	case jsCtxDivOp:
 537 | 		return "jsCtxDivOp"
 538 | 	case jsCtxUnknown:
 539 | 		return "jsCtxUnknown"
 540 | 	}
 541 | 	return fmt.Sprintf("illegal jsCtx %d", int(c))
 542 | }
 543 | 
 544 | // element identifies the HTML element when inside a start tag or special body.
 545 | // Certain HTML element (for example <script> and <style>) have bodies that are
 546 | // treated differently from stateText so the element type is necessary to
 547 | // transition into the correct context at the end of a tag and to identify the
 548 | // end delimiter for the body.
 549 | type element uint8
 550 | 
 551 | const (
 552 | 	// elementNone occurs outside a special tag or special element body.
 553 | 	elementNone element = iota
 554 | 	// elementScript corresponds to the raw text <script> element.
 555 | 	elementScript
 556 | 	// elementStyle corresponds to the raw text <style> element.
 557 | 	elementStyle
 558 | 	// elementTextarea corresponds to the RCDATA <textarea> element.
 559 | 	elementTextarea
 560 | 	// elementTitle corresponds to the RCDATA <title> element.
 561 | 	elementTitle
 562 | )
 563 | 
 564 | var elementNames = [...]string{
 565 | 	elementNone:     "elementNone",
 566 | 	elementScript:   "elementScript",
 567 | 	elementStyle:    "elementStyle",
 568 | 	elementTextarea: "elementTextarea",
 569 | 	elementTitle:    "elementTitle",
 570 | }
 571 | 
 572 | func (e element) String() string {
 573 | 	if int(e) < len(elementNames) {
 574 | 		return elementNames[e]
 575 | 	}
 576 | 	return fmt.Sprintf("illegal element %d", int(e))
 577 | }
 578 | 
 579 | // attr identifies the most recent HTML attribute when inside a start tag.
 580 | type attr uint8
 581 | 
 582 | const (
 583 | 	// attrNone corresponds to a normal attribute or no attribute.
 584 | 	attrNone attr = iota
 585 | 	// attrScript corresponds to an event handler attribute.
 586 | 	attrScript
 587 | 	// attrStyle corresponds to the style attribute whose value is CSS.
 588 | 	attrStyle
 589 | 	// attrURL corresponds to an attribute whose value is a URL.
 590 | 	attrURL
 591 | )
 592 | 
 593 | var attrNames = [...]string{
 594 | 	attrNone:   "attrNone",
 595 | 	attrScript: "attrScript",
 596 | 	attrStyle:  "attrStyle",
 597 | 	attrURL:    "attrURL",
 598 | }
 599 | 
 600 | func (a attr) String() string {
 601 | 	if int(a) < len(attrNames) {
 602 | 		return attrNames[a]
 603 | 	}
 604 | 	return fmt.Sprintf("illegal attr %d", int(a))
 605 | }
 606 | 
 607 | // Copyright 2011 The Go Authors. All rights reserved.
 608 | // Use of this source code is governed by a BSD-style
 609 | // license that can be found in the LICENSE file.
 610 | 
 611 | // escapeTemplates rewrites the named templates, which must be
 612 | // associated with t, to guarantee that the output of any of the named
 613 | // templates is properly escaped.  Names should include the names of
 614 | // all templates that might be Executed but need not include helper
 615 | // templates.  If no error is returned, then the named templates have
 616 | // been modified.  Otherwise the named templates have been rendered
 617 | // unusable.
 618 | func escapeTemplates(tmpl *Template, names ...string) error {
 619 | 	e := newEscaper(tmpl)
 620 | 	for _, name := range names {
 621 | 		c, _ := e.escapeTree(context{}, name, 0)
 622 | 		var err error
 623 | 		if c.err != nil {
 624 | 			err, c.err.Name = c.err, name
 625 | 		} else if c.state != stateText {
 626 | 			err = &Error{ErrEndContext, name, 0, fmt.Sprintf("ends in a non-text context: %v", c)}
 627 | 		}
 628 | 		if err != nil {
 629 | 			// Prevent execution of unsafe templates.
 630 | 			for _, name := range names {
 631 | 				if t := tmpl.set[name]; t != nil {
 632 | 					t.text.Tree = nil
 633 | 					t.Tree = nil
 634 | 				}
 635 | 			}
 636 | 			return err
 637 | 		}
 638 | 	}
 639 | 	e.commit()
 640 | 	for _, name := range names {
 641 | 		if t := tmpl.set[name]; t != nil {
 642 | 			t.escaped = true
 643 | 			t.Tree = t.text.Tree
 644 | 		}
 645 | 	}
 646 | 	return nil
 647 | }
 648 | 
 649 | // funcMap maps command names to functions that render their inputs safe.
 650 | var funcMap = template.FuncMap{
 651 | 	"html_template_attrescaper":     attrEscaper,
 652 | 	"html_template_commentescaper":  commentEscaper,
 653 | 	"html_template_cssescaper":      cssEscaper,
 654 | 	"html_template_cssvaluefilter":  cssValueFilter,
 655 | 	"html_template_htmlnamefilter":  htmlNameFilter,
 656 | 	"html_template_htmlescaper":     htmlEscaper,
 657 | 	"html_template_jsregexpescaper": jsRegexpEscaper,
 658 | 	"html_template_jsstrescaper":    jsStrEscaper,
 659 | 	"html_template_jsvalescaper":    jsValEscaper,
 660 | 	"html_template_nospaceescaper":  htmlNospaceEscaper,
 661 | 	"html_template_rcdataescaper":   rcdataEscaper,
 662 | 	"html_template_urlescaper":      urlEscaper,
 663 | 	"html_template_urlfilter":       urlFilter,
 664 | 	"html_template_urlnormalizer":   urlNormalizer,
 665 | }
 666 | 
 667 | // equivEscapers matches contextual escapers to equivalent template builtins.
 668 | var equivEscapers = map[string]string{
 669 | 	"html_template_attrescaper":    "html",
 670 | 	"html_template_htmlescaper":    "html",
 671 | 	"html_template_nospaceescaper": "html",
 672 | 	"html_template_rcdataescaper":  "html",
 673 | 	"html_template_urlescaper":     "urlquery",
 674 | 	"html_template_urlnormalizer":  "urlquery",
 675 | }
 676 | 
 677 | // escaper collects type inferences about templates and changes needed to make
 678 | // templates injection safe.
 679 | type escaper struct {
 680 | 	tmpl *Template
 681 | 	// output[templateName] is the output context for a templateName that
 682 | 	// has been mangled to include its input context.
 683 | 	output map[string]context
 684 | 	// derived[c.mangle(name)] maps to a template derived from the template
 685 | 	// named name templateName for the start context c.
 686 | 	derived map[string]*template.Template
 687 | 	// called[templateName] is a set of called mangled template names.
 688 | 	called map[string]bool
 689 | 	// xxxNodeEdits are the accumulated edits to apply during commit.
 690 | 	// Such edits are not applied immediately in case a template set
 691 | 	// executes a given template in different escaping contexts.
 692 | 	actionNodeEdits   map[*parse.ActionNode][]string
 693 | 	templateNodeEdits map[*parse.TemplateNode]string
 694 | 	textNodeEdits     map[*parse.TextNode][]byte
 695 | }
 696 | 
 697 | // newEscaper creates a blank escaper for the given set.
 698 | func newEscaper(t *Template) *escaper {
 699 | 	return &escaper{
 700 | 		t,
 701 | 		map[string]context{},
 702 | 		map[string]*template.Template{},
 703 | 		map[string]bool{},
 704 | 		map[*parse.ActionNode][]string{},
 705 | 		map[*parse.TemplateNode]string{},
 706 | 		map[*parse.TextNode][]byte{},
 707 | 	}
 708 | }
 709 | 
 710 | // filterFailsafe is an innocuous word that is emitted in place of unsafe values
 711 | // by sanitizer functions. It is not a keyword in any programming language,
 712 | // contains no special characters, is not empty, and when it appears in output
 713 | // it is distinct enough that a developer can find the source of the problem
 714 | // via a search engine.
 715 | const filterFailsafe = "ZgotmplZ"
 716 | 
 717 | // escape escapes a template node.
 718 | func (e *escaper) escape(c context, n parse.Node) context {
 719 | 	switch n := n.(type) {
 720 | 	case *parse.ActionNode:
 721 | 		return e.escapeAction(c, n)
 722 | 	case *parse.IfNode:
 723 | 		return e.escapeBranch(c, &n.BranchNode, "if")
 724 | 	case *parse.ListNode:
 725 | 		return e.escapeList(c, n)
 726 | 	case *parse.RangeNode:
 727 | 		return e.escapeBranch(c, &n.BranchNode, "range")
 728 | 	case *parse.TemplateNode:
 729 | 		return e.escapeTemplate(c, n)
 730 | 	case *parse.TextNode:
 731 | 		return e.escapeText(c, n)
 732 | 	case *parse.WithNode:
 733 | 		return e.escapeBranch(c, &n.BranchNode, "with")
 734 | 	}
 735 | 	panic("escaping " + n.String() + " is unimplemented")
 736 | }
 737 | 
 738 | // escapeAction escapes an action template node.
 739 | func (e *escaper) escapeAction(c context, n *parse.ActionNode) context {
 740 | 	if len(n.Pipe.Decl) != 0 {
 741 | 		// A local variable assignment, not an interpolation.
 742 | 		return c
 743 | 	}
 744 | 	c = nudge(c)
 745 | 	s := make([]string, 0, 3)
 746 | 	switch c.state {
 747 | 	case stateError:
 748 | 		return c
 749 | 	case stateURL, stateCSSDqStr, stateCSSSqStr, stateCSSDqURL, stateCSSSqURL, stateCSSURL:
 750 | 		switch c.urlPart {
 751 | 		case urlPartNone:
 752 | 			s = append(s, "html_template_urlfilter")
 753 | 			fallthrough
 754 | 		case urlPartPreQuery:
 755 | 			switch c.state {
 756 | 			case stateCSSDqStr, stateCSSSqStr:
 757 | 				s = append(s, "html_template_cssescaper")
 758 | 			default:
 759 | 				s = append(s, "html_template_urlnormalizer")
 760 | 			}
 761 | 		case urlPartQueryOrFrag:
 762 | 			s = append(s, "html_template_urlescaper")
 763 | 		case urlPartUnknown:
 764 | 			return context{
 765 | 				state: stateError,
 766 | 				err:   errorf(ErrAmbigContext, n.Line, "%s appears in an ambiguous URL context", n),
 767 | 			}
 768 | 		default:
 769 | 			panic(c.urlPart.String())
 770 | 		}
 771 | 	case stateJS:
 772 | 		s = append(s, "html_template_jsvalescaper")
 773 | 		// A slash after a value starts a div operator.
 774 | 		c.jsCtx = jsCtxDivOp
 775 | 	case stateJSDqStr, stateJSSqStr:
 776 | 		s = append(s, "html_template_jsstrescaper")
 777 | 	case stateJSRegexp:
 778 | 		s = append(s, "html_template_jsregexpescaper")
 779 | 	case stateCSS:
 780 | 		s = append(s, "html_template_cssvaluefilter")
 781 | 	case stateText:
 782 | 		s = append(s, "html_template_htmlescaper")
 783 | 	case stateRCDATA:
 784 | 		s = append(s, "html_template_rcdataescaper")
 785 | 	case stateAttr:
 786 | 		// Handled below in delim check.
 787 | 	case stateAttrName, stateTag:
 788 | 		c.state = stateAttrName
 789 | 		s = append(s, "html_template_htmlnamefilter")
 790 | 	default:
 791 | 		if isComment(c.state) {
 792 | 			s = append(s, "html_template_commentescaper")
 793 | 		} else {
 794 | 			panic("unexpected state " + c.state.String())
 795 | 		}
 796 | 	}
 797 | 	switch c.delim {
 798 | 	case delimNone:
 799 | 		// No extra-escaping needed for raw text content.
 800 | 	case delimSpaceOrTagEnd:
 801 | 		s = append(s, "html_template_nospaceescaper")
 802 | 	default:
 803 | 		s = append(s, "html_template_attrescaper")
 804 | 	}
 805 | 	e.editActionNode(n, s)
 806 | 	return c
 807 | }
 808 | 
 809 | // allIdents returns the names of the identifiers under the Ident field of the node,
 810 | // which might be a singleton (Identifier) or a slice (Field).
 811 | func allIdents(node parse.Node) []string {
 812 | 	switch node := node.(type) {
 813 | 	case *parse.IdentifierNode:
 814 | 		return []string{node.Ident}
 815 | 	case *parse.FieldNode:
 816 | 		return node.Ident
 817 | 	}
 818 | 	panic("unidentified node type in allIdents")
 819 | }
 820 | 
 821 | // ensurePipelineContains ensures that the pipeline has commands with
 822 | // the identifiers in s in order.
 823 | // If the pipeline already has some of the sanitizers, do not interfere.
 824 | // For example, if p is (.X | html) and s is ["escapeJSVal", "html"] then it
 825 | // has one matching, "html", and one to insert, "escapeJSVal", to produce
 826 | // (.X | escapeJSVal | html).
 827 | func ensurePipelineContains(p *parse.PipeNode, s []string) {
 828 | 	if len(s) == 0 {
 829 | 		return
 830 | 	}
 831 | 	n := len(p.Cmds)
 832 | 	// Find the identifiers at the end of the command chain.
 833 | 	idents := p.Cmds
 834 | 	for i := n - 1; i >= 0; i-- {
 835 | 		if cmd := p.Cmds[i]; len(cmd.Args) != 0 {
 836 | 			if _, ok := cmd.Args[0].(*parse.IdentifierNode); ok {
 837 | 				continue
 838 | 			}
 839 | 		}
 840 | 		idents = p.Cmds[i+1:]
 841 | 	}
 842 | 	dups := 0
 843 | 	for _, idNode := range idents {
 844 | 		for _, ident := range allIdents(idNode.Args[0]) {
 845 | 			if escFnsEq(s[dups], ident) {
 846 | 				dups++
 847 | 				if dups == len(s) {
 848 | 					return
 849 | 				}
 850 | 			}
 851 | 		}
 852 | 	}
 853 | 	newCmds := make([]*parse.CommandNode, n-len(idents), n+len(s)-dups)
 854 | 	copy(newCmds, p.Cmds)
 855 | 	// Merge existing identifier commands with the sanitizers needed.
 856 | 	for _, idNode := range idents {
 857 | 		pos := idNode.Args[0].Position()
 858 | 		for _, ident := range allIdents(idNode.Args[0]) {
 859 | 			i := indexOfStr(ident, s, escFnsEq)
 860 | 			if i != -1 {
 861 | 				for _, name := range s[:i] {
 862 | 					newCmds = appendCmd(newCmds, newIdentCmd(name, pos))
 863 | 				}
 864 | 				s = s[i+1:]
 865 | 			}
 866 | 		}
 867 | 		newCmds = appendCmd(newCmds, idNode)
 868 | 	}
 869 | 	// Create any remaining sanitizers.
 870 | 	for _, name := range s {
 871 | 		newCmds = appendCmd(newCmds, newIdentCmd(name, p.Position()))
 872 | 	}
 873 | 	p.Cmds = newCmds
 874 | }
 875 | 
 876 | // redundantFuncs[a][b] implies that funcMap[b](funcMap[a](x)) == funcMap[a](x)
 877 | // for all x.
 878 | var redundantFuncs = map[string]map[string]bool{
 879 | 	"html_template_commentescaper": {
 880 | 		"html_template_attrescaper":    true,
 881 | 		"html_template_nospaceescaper": true,
 882 | 		"html_template_htmlescaper":    true,
 883 | 	},
 884 | 	"html_template_cssescaper": {
 885 | 		"html_template_attrescaper": true,
 886 | 	},
 887 | 	"html_template_jsregexpescaper": {
 888 | 		"html_template_attrescaper": true,
 889 | 	},
 890 | 	"html_template_jsstrescaper": {
 891 | 		"html_template_attrescaper": true,
 892 | 	},
 893 | 	"html_template_urlescaper": {
 894 | 		"html_template_urlnormalizer": true,
 895 | 	},
 896 | }
 897 | 
 898 | // appendCmd appends the given command to the end of the command pipeline
 899 | // unless it is redundant with the last command.
 900 | func appendCmd(cmds []*parse.CommandNode, cmd *parse.CommandNode) []*parse.CommandNode {
 901 | 	if n := len(cmds); n != 0 {
 902 | 		last, ok := cmds[n-1].Args[0].(*parse.IdentifierNode)
 903 | 		next, _ := cmd.Args[0].(*parse.IdentifierNode)
 904 | 		if ok && redundantFuncs[last.Ident][next.Ident] {
 905 | 			return cmds
 906 | 		}
 907 | 	}
 908 | 	return append(cmds, cmd)
 909 | }
 910 | 
 911 | // indexOfStr is the first i such that eq(s, strs[i]) or -1 if s was not found.
 912 | func indexOfStr(s string, strs []string, eq func(a, b string) bool) int {
 913 | 	for i, t := range strs {
 914 | 		if eq(s, t) {
 915 | 			return i
 916 | 		}
 917 | 	}
 918 | 	return -1
 919 | }
 920 | 
 921 | // escFnsEq reports whether the two escaping functions are equivalent.
 922 | func escFnsEq(a, b string) bool {
 923 | 	if e := equivEscapers[a]; e != "" {
 924 | 		a = e
 925 | 	}
 926 | 	if e := equivEscapers[b]; e != "" {
 927 | 		b = e
 928 | 	}
 929 | 	return a == b
 930 | }
 931 | 
 932 | // newIdentCmd produces a command containing a single identifier node.
 933 | func newIdentCmd(identifier string, pos parse.Pos) *parse.CommandNode {
 934 | 	return &parse.CommandNode{
 935 | 		NodeType: parse.NodeCommand,
 936 | 		Args:     []parse.Node{parse.NewIdentifier(identifier).SetPos(pos)},
 937 | 	}
 938 | }
 939 | 
 940 | // nudge returns the context that would result from following empty string
 941 | // transitions from the input context.
 942 | // For example, parsing:
 943 | //
 944 | //	`<a href=`
 945 | //
 946 | // will end in context{stateBeforeValue, attrURL}, but parsing one extra rune:
 947 | //
 948 | //	`<a href=x`
 949 | //
 950 | // will end in context{stateURL, delimSpaceOrTagEnd, ...}.
 951 | // There are two transitions that happen when the 'x' is seen:
 952 | // (1) Transition from a before-value state to a start-of-value state without
 953 | //
 954 | //	consuming any character.
 955 | //
 956 | // (2) Consume 'x' and transition past the first value character.
 957 | // In this case, nudging produces the context after (1) happens.
 958 | func nudge(c context) context {
 959 | 	switch c.state {
 960 | 	case stateTag:
 961 | 		// In `<foo {{.}}`, the action should emit an attribute.
 962 | 		c.state = stateAttrName
 963 | 	case stateBeforeValue:
 964 | 		// In `<foo bar={{.}}`, the action is an undelimited value.
 965 | 		c.state, c.delim, c.attr = attrStartStates[c.attr], delimSpaceOrTagEnd, attrNone
 966 | 	case stateAfterName:
 967 | 		// In `<foo bar {{.}}`, the action is an attribute name.
 968 | 		c.state, c.attr = stateAttrName, attrNone
 969 | 	}
 970 | 	return c
 971 | }
 972 | 
 973 | // join joins the two contexts of a branch template node. The result is an
 974 | // error context if either of the input contexts are error contexts, or if the
 975 | // the input contexts differ.
 976 | func join(a, b context, line int, nodeName string) context {
 977 | 	if a.state == stateError {
 978 | 		return a
 979 | 	}
 980 | 	if b.state == stateError {
 981 | 		return b
 982 | 	}
 983 | 	if a.eq(b) {
 984 | 		return a
 985 | 	}
 986 | 
 987 | 	c := a
 988 | 	c.urlPart = b.urlPart
 989 | 	if c.eq(b) {
 990 | 		// The contexts differ only by urlPart.
 991 | 		c.urlPart = urlPartUnknown
 992 | 		return c
 993 | 	}
 994 | 
 995 | 	c = a
 996 | 	c.jsCtx = b.jsCtx
 997 | 	if c.eq(b) {
 998 | 		// The contexts differ only by jsCtx.
 999 | 		c.jsCtx = jsCtxUnknown
1000 | 		return c
1001 | 	}
1002 | 
1003 | 	// Allow a nudged context to join with an unnudged one.
1004 | 	// This means that
1005 | 	//   <p title={{if .C}}{{.}}{{end}}
1006 | 	// ends in an unquoted value state even though the else branch
1007 | 	// ends in stateBeforeValue.
1008 | 	if c, d := nudge(a), nudge(b); !(c.eq(a) && d.eq(b)) {
1009 | 		if e := join(c, d, line, nodeName); e.state != stateError {
1010 | 			return e
1011 | 		}
1012 | 	}
1013 | 
1014 | 	return context{
1015 | 		state: stateError,
1016 | 		err:   errorf(ErrBranchEnd, line, "{{%s}} branches end in different contexts: %v, %v", nodeName, a, b),
1017 | 	}
1018 | }
1019 | 
1020 | // escapeBranch escapes a branch template node: "if", "range" and "with".
1021 | func (e *escaper) escapeBranch(c context, n *parse.BranchNode, nodeName string) context {
1022 | 	c0 := e.escapeList(c, n.List)
1023 | 	if nodeName == "range" && c0.state != stateError {
1024 | 		// The "true" branch of a "range" node can execute multiple times.
1025 | 		// We check that executing n.List once results in the same context
1026 | 		// as executing n.List twice.
1027 | 		c1, _ := e.escapeListConditionally(c0, n.List, nil)
1028 | 		c0 = join(c0, c1, n.Line, nodeName)
1029 | 		if c0.state == stateError {
1030 | 			// Make clear that this is a problem on loop re-entry
1031 | 			// since developers tend to overlook that branch when
1032 | 			// debugging templates.
1033 | 			c0.err.Line = n.Line
1034 | 			c0.err.Description = "on range loop re-entry: " + c0.err.Description
1035 | 			return c0
1036 | 		}
1037 | 	}
1038 | 	c1 := e.escapeList(c, n.ElseList)
1039 | 	return join(c0, c1, n.Line, nodeName)
1040 | }
1041 | 
1042 | // escapeList escapes a list template node.
1043 | func (e *escaper) escapeList(c context, n *parse.ListNode) context {
1044 | 	if n == nil {
1045 | 		return c
1046 | 	}
1047 | 	for _, m := range n.Nodes {
1048 | 		c = e.escape(c, m)
1049 | 	}
1050 | 	return c
1051 | }
1052 | 
1053 | // escapeListConditionally escapes a list node but only preserves edits and
1054 | // inferences in e if the inferences and output context satisfy filter.
1055 | // It returns the best guess at an output context, and the result of the filter
1056 | // which is the same as whether e was updated.
1057 | func (e *escaper) escapeListConditionally(c context, n *parse.ListNode, filter func(*escaper, context) bool) (context, bool) {
1058 | 	e1 := newEscaper(e.tmpl)
1059 | 	// Make type inferences available to f.
1060 | 	for k, v := range e.output {
1061 | 		e1.output[k] = v
1062 | 	}
1063 | 	c = e1.escapeList(c, n)
1064 | 	ok := filter != nil && filter(e1, c)
1065 | 	if ok {
1066 | 		// Copy inferences and edits from e1 back into e.
1067 | 		for k, v := range e1.output {
1068 | 			e.output[k] = v
1069 | 		}
1070 | 		for k, v := range e1.derived {
1071 | 			e.derived[k] = v
1072 | 		}
1073 | 		for k, v := range e1.called {
1074 | 			e.called[k] = v
1075 | 		}
1076 | 		for k, v := range e1.actionNodeEdits {
1077 | 			e.editActionNode(k, v)
1078 | 		}
1079 | 		for k, v := range e1.templateNodeEdits {
1080 | 			e.editTemplateNode(k, v)
1081 | 		}
1082 | 		for k, v := range e1.textNodeEdits {
1083 | 			e.editTextNode(k, v)
1084 | 		}
1085 | 	}
1086 | 	return c, ok
1087 | }
1088 | 
1089 | // escapeTemplate escapes a {{template}} call node.
1090 | func (e *escaper) escapeTemplate(c context, n *parse.TemplateNode) context {
1091 | 	c, name := e.escapeTree(c, n.Name, n.Line)
1092 | 	if name != n.Name {
1093 | 		e.editTemplateNode(n, name)
1094 | 	}
1095 | 	return c
1096 | }
1097 | 
1098 | // escapeTree escapes the named template starting in the given context as
1099 | // necessary and returns its output context.
1100 | func (e *escaper) escapeTree(c context, name string, line int) (context, string) {
1101 | 	// Mangle the template name with the input context to produce a reliable
1102 | 	// identifier.
1103 | 	dname := c.mangle(name)
1104 | 	e.called[dname] = true
1105 | 	if out, ok := e.output[dname]; ok {
1106 | 		// Already escaped.
1107 | 		return out, dname
1108 | 	}
1109 | 	t := e.template(name)
1110 | 	if t == nil {
1111 | 		// Two cases: The template exists but is empty, or has never been mentioned at
1112 | 		// all. Distinguish the cases in the error messages.
1113 | 		if e.tmpl.set[name] != nil {
1114 | 			return context{
1115 | 				state: stateError,
1116 | 				err:   errorf(ErrNoSuchTemplate, line, "%q is an incomplete or empty template", name),
1117 | 			}, dname
1118 | 		}
1119 | 		return context{
1120 | 			state: stateError,
1121 | 			err:   errorf(ErrNoSuchTemplate, line, "no such template %q", name),
1122 | 		}, dname
1123 | 	}
1124 | 	if dname != name {
1125 | 		// Use any template derived during an earlier call to escapeTemplate
1126 | 		// with different top level templates, or clone if necessary.
1127 | 		dt := e.template(dname)
1128 | 		if dt == nil {
1129 | 			dt = template.New(dname)
1130 | 			dt.Tree = &parse.Tree{Name: dname, Root: t.Root.CopyList()}
1131 | 			e.derived[dname] = dt
1132 | 		}
1133 | 		t = dt
1134 | 	}
1135 | 	return e.computeOutCtx(c, t), dname
1136 | }
1137 | 
1138 | // computeOutCtx takes a template and its start context and computes the output
1139 | // context while storing any inferences in e.
1140 | func (e *escaper) computeOutCtx(c context, t *template.Template) context {
1141 | 	// Propagate context over the body.
1142 | 	c1, ok := e.escapeTemplateBody(c, t)
1143 | 	if !ok {
1144 | 		// Look for a fixed point by assuming c1 as the output context.
1145 | 		if c2, ok2 := e.escapeTemplateBody(c1, t); ok2 {
1146 | 			c1, ok = c2, true
1147 | 		}
1148 | 		// Use c1 as the error context if neither assumption worked.
1149 | 	}
1150 | 	if !ok && c1.state != stateError {
1151 | 		return context{
1152 | 			state: stateError,
1153 | 			// TODO: Find the first node with a line in t.text.Tree.Root
1154 | 			err: errorf(ErrOutputContext, 0, "cannot compute output context for template %s", t.Name()),
1155 | 		}
1156 | 	}
1157 | 	return c1
1158 | }
1159 | 
1160 | // escapeTemplateBody escapes the given template assuming the given output
1161 | // context, and returns the best guess at the output context and whether the
1162 | // assumption was correct.
1163 | func (e *escaper) escapeTemplateBody(c context, t *template.Template) (context, bool) {
1164 | 	filter := func(e1 *escaper, c1 context) bool {
1165 | 		if c1.state == stateError {
1166 | 			// Do not update the input escaper, e.
1167 | 			return false
1168 | 		}
1169 | 		if !e1.called[t.Name()] {
1170 | 			// If t is not recursively called, then c1 is an
1171 | 			// accurate output context.
1172 | 			return true
1173 | 		}
1174 | 		// c1 is accurate if it matches our assumed output context.
1175 | 		return c.eq(c1)
1176 | 	}
1177 | 	// We need to assume an output context so that recursive template calls
1178 | 	// take the fast path out of escapeTree instead of infinitely recursing.
1179 | 	// Naively assuming that the input context is the same as the output
1180 | 	// works >90% of the time.
1181 | 	e.output[t.Name()] = c
1182 | 	return e.escapeListConditionally(c, t.Tree.Root, filter)
1183 | }
1184 | 
1185 | // delimEnds maps each delim to a string of characters that terminate it.
1186 | var delimEnds = [...]string{
1187 | 	delimDoubleQuote: `"`,
1188 | 	delimSingleQuote: "'",
1189 | 	// Determined empirically by running the below in various browsers.
1190 | 	// var div = document.createElement("DIV");
1191 | 	// for (var i = 0; i < 0x10000; ++i) {
1192 | 	//   div.innerHTML = "<span title=x" + String.fromCharCode(i) + "-bar>";
1193 | 	//   if (div.getElementsByTagName("SPAN")[0].title.indexOf("bar") < 0)
1194 | 	//     document.write("<p>U+" + i.toString(16));
1195 | 	// }
1196 | 	delimSpaceOrTagEnd: " \t\n\f\r>",
1197 | }
1198 | 
1199 | var doctypeBytes = []byte("<!DOCTYPE")
1200 | 
1201 | // escapeText escapes a text template node.
1202 | func (e *escaper) escapeText(c context, n *parse.TextNode) context {
1203 | 	s, written, i, b := n.Text, 0, 0, new(bytes.Buffer)
1204 | 	for i != len(s) {
1205 | 		c1, nread := contextAfterText(c, s[i:])
1206 | 		i1 := i + nread
1207 | 		if c.state == stateText || c.state == stateRCDATA {
1208 | 			end := i1
1209 | 			if c1.state != c.state {
1210 | 				for j := end - 1; j >= i; j-- {
1211 | 					if s[j] == '<' {
1212 | 						end = j
1213 | 						break
1214 | 					}
1215 | 				}
1216 | 			}
1217 | 			for j := i; j < end; j++ {
1218 | 				if s[j] == '<' && !bytes.HasPrefix(bytes.ToUpper(s[j:]), doctypeBytes) {
1219 | 					b.Write(s[written:j])
1220 | 					b.WriteString("&lt;")
1221 | 					written = j + 1
1222 | 				}
1223 | 			}
1224 | 		} else if isComment(c.state) && c.delim == delimNone {
1225 | 			switch c.state {
1226 | 			case stateJSBlockCmt:
1227 | 				// http://es5.github.com/#x7.4:
1228 | 				// "Comments behave like white space and are
1229 | 				// discarded except that, if a MultiLineComment
1230 | 				// contains a line terminator character, then
1231 | 				// the entire comment is considered to be a
1232 | 				// LineTerminator for purposes of parsing by
1233 | 				// the syntactic grammar."
1234 | 				if bytes.IndexAny(s[written:i1], "\n\r\u2028\u2029") != -1 {
1235 | 					b.WriteByte('\n')
1236 | 				} else {
1237 | 					b.WriteByte(' ')
1238 | 				}
1239 | 			case stateCSSBlockCmt:
1240 | 				b.WriteByte(' ')
1241 | 			}
1242 | 			written = i1
1243 | 		}
1244 | 		if c.state != c1.state && isComment(c1.state) && c1.delim == delimNone {
1245 | 			// Preserve the portion between written and the comment start.
1246 | 			cs := i1 - 2
1247 | 			if c1.state == stateHTMLCmt {
1248 | 				// "<!--" instead of "/*" or "//"
1249 | 				cs -= 2
1250 | 			}
1251 | 			b.Write(s[written:cs])
1252 | 			written = i1
1253 | 		}
1254 | 		if i == i1 && c.state == c1.state {
1255 | 			panic(fmt.Sprintf("infinite loop from %v to %v on %q..%q", c, c1, s[:i], s[i:]))
1256 | 		}
1257 | 		c, i = c1, i1
1258 | 	}
1259 | 
1260 | 	if written != 0 && c.state != stateError {
1261 | 		if !isComment(c.state) || c.delim != delimNone {
1262 | 			b.Write(n.Text[written:])
1263 | 		}
1264 | 		e.editTextNode(n, b.Bytes())
1265 | 	}
1266 | 	return c
1267 | }
1268 | 
1269 | // contextAfterText starts in context c, consumes some tokens from the front of
1270 | // s, then returns the context after those tokens and the unprocessed suffix.
1271 | func contextAfterText(c context, s []byte) (context, int) {
1272 | 	if c.delim == delimNone {
1273 | 		c1, i := tSpecialTagEnd(c, s)
1274 | 		if i == 0 {
1275 | 			// A special end tag (`</script>`) has been seen and
1276 | 			// all content preceding it has been consumed.
1277 | 			return c1, 0
1278 | 		}
1279 | 		// Consider all content up to any end tag.
1280 | 		return transitionFunc[c.state](c, s[:i])
1281 | 	}
1282 | 
1283 | 	i := bytes.IndexAny(s, delimEnds[c.delim])
1284 | 	if i == -1 {
1285 | 		i = len(s)
1286 | 	}
1287 | 	if c.delim == delimSpaceOrTagEnd {
1288 | 		// http://www.w3.org/TR/html5/syntax.html#attribute-value-(unquoted)-state
1289 | 		// lists the runes below as error characters.
1290 | 		// Error out because HTML parsers may differ on whether
1291 | 		// "<a id= onclick=f("     ends inside id's or onclick's value,
1292 | 		// "<a class=`foo "        ends inside a value,
1293 | 		// "<a style=font:'Arial'" needs open-quote fixup.
1294 | 		// IE treats '`' as a quotation character.
1295 | 		if j := bytes.IndexAny(s[:i], "\"'<=`"); j >= 0 {
1296 | 			return context{
1297 | 				state: stateError,
1298 | 				err:   errorf(ErrBadHTML, 0, "%q in unquoted attr: %q", s[j:j+1], s[:i]),
1299 | 			}, len(s)
1300 | 		}
1301 | 	}
1302 | 	if i == len(s) {
1303 | 		// Remain inside the attribute.
1304 | 		// Decode the value so non-HTML rules can easily handle
1305 | 		//     <button onclick="alert(&quot;Hi!&quot;)">
1306 | 		// without having to entity decode token boundaries.
1307 | 		for u := []byte(html.UnescapeString(string(s))); len(u) != 0; {
1308 | 			c1, i1 := transitionFunc[c.state](c, u)
1309 | 			c, u = c1, u[i1:]
1310 | 		}
1311 | 		return c, len(s)
1312 | 	}
1313 | 	if c.delim != delimSpaceOrTagEnd {
1314 | 		// Consume any quote.
1315 | 		i++
1316 | 	}
1317 | 	// On exiting an attribute, we discard all state information
1318 | 	// except the state and element.
1319 | 	return context{state: stateTag, element: c.element}, i
1320 | }
1321 | 
1322 | // editActionNode records a change to an action pipeline for later commit.
1323 | func (e *escaper) editActionNode(n *parse.ActionNode, cmds []string) {
1324 | 	if _, ok := e.actionNodeEdits[n]; ok {
1325 | 		panic(fmt.Sprintf("node %s shared between templates", n))
1326 | 	}
1327 | 	e.actionNodeEdits[n] = cmds
1328 | }
1329 | 
1330 | // editTemplateNode records a change to a {{template}} callee for later commit.
1331 | func (e *escaper) editTemplateNode(n *parse.TemplateNode, callee string) {
1332 | 	if _, ok := e.templateNodeEdits[n]; ok {
1333 | 		panic(fmt.Sprintf("node %s shared between templates", n))
1334 | 	}
1335 | 	e.templateNodeEdits[n] = callee
1336 | }
1337 | 
1338 | // editTextNode records a change to a text node for later commit.
1339 | func (e *escaper) editTextNode(n *parse.TextNode, text []byte) {
1340 | 	if _, ok := e.textNodeEdits[n]; ok {
1341 | 		panic(fmt.Sprintf("node %s shared between templates", n))
1342 | 	}
1343 | 	e.textNodeEdits[n] = text
1344 | }
1345 | 
1346 | // commit applies changes to actions and template calls needed to contextually
1347 | // autoescape content and adds any derived templates to the set.
1348 | func (e *escaper) commit() {
1349 | 	for name := range e.output {
1350 | 		e.template(name).Funcs(funcMap)
1351 | 	}
1352 | 	for _, t := range e.derived {
1353 | 		if _, err := e.tmpl.text.AddParseTree(t.Name(), t.Tree); err != nil {
1354 | 			panic("error adding derived template")
1355 | 		}
1356 | 	}
1357 | 	for n, s := range e.actionNodeEdits {
1358 | 		ensurePipelineContains(n.Pipe, s)
1359 | 	}
1360 | 	for n, name := range e.templateNodeEdits {
1361 | 		n.Name = name
1362 | 	}
1363 | 	for n, s := range e.textNodeEdits {
1364 | 		n.Text = s
1365 | 	}
1366 | }
1367 | 
1368 | // template returns the named template given a mangled template name.
1369 | func (e *escaper) template(name string) *template.Template {
1370 | 	t := e.tmpl.text.Lookup(name)
1371 | 	if t == nil {
1372 | 		t = e.derived[name]
1373 | 	}
1374 | 	return t
1375 | }
1376 | 
1377 | // Forwarding functions so that clients need only import this package
1378 | // to reach the general escaping functions of text/template.
1379 | 
1380 | // HTMLEscape writes to w the escaped HTML equivalent of the plain text data b.
1381 | func HTMLEscape(w io.Writer, b []byte) {
1382 | 	template.HTMLEscape(w, b)
1383 | }
1384 | 
1385 | // HTMLEscapeString returns the escaped HTML equivalent of the plain text data s.
1386 | func HTMLEscapeString(s string) string {
1387 | 	return template.HTMLEscapeString(s)
1388 | }
1389 | 
1390 | // HTMLEscaper returns the escaped HTML equivalent of the textual
1391 | // representation of its arguments.
1392 | func HTMLEscaper(args ...interface{}) string {
1393 | 	return template.HTMLEscaper(args...)
1394 | }
1395 | 
1396 | // JSEscape writes to w the escaped JavaScript equivalent of the plain text data b.
1397 | func JSEscape(w io.Writer, b []byte) {
1398 | 	template.JSEscape(w, b)
1399 | }
1400 | 
1401 | // JSEscapeString returns the escaped JavaScript equivalent of the plain text data s.
1402 | func JSEscapeString(s string) string {
1403 | 	return template.JSEscapeString(s)
1404 | }
1405 | 
1406 | // JSEscaper returns the escaped JavaScript equivalent of the textual
1407 | // representation of its arguments.
1408 | func JSEscaper(args ...interface{}) string {
1409 | 	return template.JSEscaper(args...)
1410 | }
1411 | 
1412 | // URLQueryEscaper returns the escaped value of the textual representation of
1413 | // its arguments in a form suitable for embedding in a URL query.
1414 | func URLQueryEscaper(args ...interface{}) string {
1415 | 	return template.URLQueryEscaper(args...)
1416 | }
1417 | 
1418 | // Copyright 2011 The Go Authors. All rights reserved.
1419 | // Use of this source code is governed by a BSD-style
1420 | // license that can be found in the LICENSE file.
1421 | 
1422 | // transitionFunc is the array of context transition functions for text nodes.
1423 | // A transition function takes a context and template text input, and returns
1424 | // the updated context and the number of bytes consumed from the front of the
1425 | // input.
1426 | var transitionFunc = [...]func(context, []byte) (context, int){
1427 | 	stateText:        tText,
1428 | 	stateTag:         tTag,
1429 | 	stateAttrName:    tAttrName,
1430 | 	stateAfterName:   tAfterName,
1431 | 	stateBeforeValue: tBeforeValue,
1432 | 	stateHTMLCmt:     tHTMLCmt,
1433 | 	stateRCDATA:      tSpecialTagEnd,
1434 | 	stateAttr:        tAttr,
1435 | 	stateURL:         tURL,
1436 | 	stateJS:          tJS,
1437 | 	stateJSDqStr:     tJSDelimited,
1438 | 	stateJSSqStr:     tJSDelimited,
1439 | 	stateJSRegexp:    tJSDelimited,
1440 | 	stateJSBlockCmt:  tBlockCmt,
1441 | 	stateJSLineCmt:   tLineCmt,
1442 | 	stateCSS:         tCSS,
1443 | 	stateCSSDqStr:    tCSSStr,
1444 | 	stateCSSSqStr:    tCSSStr,
1445 | 	stateCSSDqURL:    tCSSStr,
1446 | 	stateCSSSqURL:    tCSSStr,
1447 | 	stateCSSURL:      tCSSStr,
1448 | 	stateCSSBlockCmt: tBlockCmt,
1449 | 	stateCSSLineCmt:  tLineCmt,
1450 | 	stateError:       tError,
1451 | }
1452 | 
1453 | var commentStart = []byte("<!--")
1454 | var commentEnd = []byte("-->")
1455 | 
1456 | // tText is the context transition function for the text state.
1457 | func tText(c context, s []byte) (context, int) {
1458 | 	k := 0
1459 | 	for {
1460 | 		i := k + bytes.IndexByte(s[k:], '<')
1461 | 		if i < k || i+1 == len(s) {
1462 | 			return c, len(s)
1463 | 		} else if i+4 <= len(s) && bytes.Equal(commentStart, s[i:i+4]) {
1464 | 			return context{state: stateHTMLCmt}, i + 4
1465 | 		}
1466 | 		i++
1467 | 		end := false
1468 | 		if s[i] == '/' {
1469 | 			if i+1 == len(s) {
1470 | 				return c, len(s)
1471 | 			}
1472 | 			end, i = true, i+1
1473 | 		}
1474 | 		j, e := eatTagName(s, i)
1475 | 		if j != i {
1476 | 			if end {
1477 | 				e = elementNone
1478 | 			}
1479 | 			// We've found an HTML tag.
1480 | 			return context{state: stateTag, element: e}, j
1481 | 		}
1482 | 		k = j
1483 | 	}
1484 | }
1485 | 
1486 | var elementContentType = [...]state{
1487 | 	elementNone:     stateText,
1488 | 	elementScript:   stateJS,
1489 | 	elementStyle:    stateCSS,
1490 | 	elementTextarea: stateRCDATA,
1491 | 	elementTitle:    stateRCDATA,
1492 | }
1493 | 
1494 | // tTag is the context transition function for the tag state.
1495 | func tTag(c context, s []byte) (context, int) {
1496 | 	// Find the attribute name.
1497 | 	i := eatWhiteSpace(s, 0)
1498 | 	if i == len(s) {
1499 | 		return c, len(s)
1500 | 	}
1501 | 	if s[i] == '>' {
1502 | 		return context{
1503 | 			state:   elementContentType[c.element],
1504 | 			element: c.element,
1505 | 		}, i + 1
1506 | 	}
1507 | 	j, err := eatAttrName(s, i)
1508 | 	if err != nil {
1509 | 		return context{state: stateError, err: err}, len(s)
1510 | 	}
1511 | 	state, attr := stateTag, attrNone
1512 | 	if i == j {
1513 | 		return context{
1514 | 			state: stateError,
1515 | 			err:   errorf(ErrBadHTML, 0, "expected space, attr name, or end of tag, but got %q", s[i:]),
1516 | 		}, len(s)
1517 | 	}
1518 | 	switch attrType(string(s[i:j])) {
1519 | 	case contentTypeURL:
1520 | 		attr = attrURL
1521 | 	case contentTypeCSS:
1522 | 		attr = attrStyle
1523 | 	case contentTypeJS:
1524 | 		attr = attrScript
1525 | 	}
1526 | 	if j == len(s) {
1527 | 		state = stateAttrName
1528 | 	} else {
1529 | 		state = stateAfterName
1530 | 	}
1531 | 	return context{state: state, element: c.element, attr: attr}, j
1532 | }
1533 | 
1534 | // tAttrName is the context transition function for stateAttrName.
1535 | func tAttrName(c context, s []byte) (context, int) {
1536 | 	i, err := eatAttrName(s, 0)
1537 | 	if err != nil {
1538 | 		return context{state: stateError, err: err}, len(s)
1539 | 	} else if i != len(s) {
1540 | 		c.state = stateAfterName
1541 | 	}
1542 | 	return c, i
1543 | }
1544 | 
1545 | // tAfterName is the context transition function for stateAfterName.
1546 | func tAfterName(c context, s []byte) (context, int) {
1547 | 	// Look for the start of the value.
1548 | 	i := eatWhiteSpace(s, 0)
1549 | 	if i == len(s) {
1550 | 		return c, len(s)
1551 | 	} else if s[i] != '=' {
1552 | 		// Occurs due to tag ending '>', and valueless attribute.
1553 | 		c.state = stateTag
1554 | 		return c, i
1555 | 	}
1556 | 	c.state = stateBeforeValue
1557 | 	// Consume the "=".
1558 | 	return c, i + 1
1559 | }
1560 | 
1561 | var attrStartStates = [...]state{
1562 | 	attrNone:   stateAttr,
1563 | 	attrScript: stateJS,
1564 | 	attrStyle:  stateCSS,
1565 | 	attrURL:    stateURL,
1566 | }
1567 | 
1568 | // tBeforeValue is the context transition function for stateBeforeValue.
1569 | func tBeforeValue(c context, s []byte) (context, int) {
1570 | 	i := eatWhiteSpace(s, 0)
1571 | 	if i == len(s) {
1572 | 		return c, len(s)
1573 | 	}
1574 | 	// Find the attribute delimiter.
1575 | 	delim := delimSpaceOrTagEnd
1576 | 	switch s[i] {
1577 | 	case '\'':
1578 | 		delim, i = delimSingleQuote, i+1
1579 | 	case '"':
1580 | 		delim, i = delimDoubleQuote, i+1
1581 | 	}
1582 | 	c.state, c.delim, c.attr = attrStartStates[c.attr], delim, attrNone
1583 | 	return c, i
1584 | }
1585 | 
1586 | // tHTMLCmt is the context transition function for stateHTMLCmt.
1587 | func tHTMLCmt(c context, s []byte) (context, int) {
1588 | 	if i := bytes.Index(s, commentEnd); i != -1 {
1589 | 		return context{}, i + 3
1590 | 	}
1591 | 	return c, len(s)
1592 | }
1593 | 
1594 | // specialTagEndMarkers maps element types to the character sequence that
1595 | // case-insensitively signals the end of the special tag body.
1596 | var specialTagEndMarkers = [...]string{
1597 | 	elementScript:   "</script",
1598 | 	elementStyle:    "</style",
1599 | 	elementTextarea: "</textarea",
1600 | 	elementTitle:    "</title",
1601 | }
1602 | 
1603 | // tSpecialTagEnd is the context transition function for raw text and RCDATA
1604 | // element states.
1605 | func tSpecialTagEnd(c context, s []byte) (context, int) {
1606 | 	if c.element != elementNone {
1607 | 		if i := strings.Index(strings.ToLower(string(s)), specialTagEndMarkers[c.element]); i != -1 {
1608 | 			return context{}, i
1609 | 		}
1610 | 	}
1611 | 	return c, len(s)
1612 | }
1613 | 
1614 | // tAttr is the context transition function for the attribute state.
1615 | func tAttr(c context, s []byte) (context, int) {
1616 | 	return c, len(s)
1617 | }
1618 | 
1619 | // tURL is the context transition function for the URL state.
1620 | func tURL(c context, s []byte) (context, int) {
1621 | 	if bytes.IndexAny(s, "#?") >= 0 {
1622 | 		c.urlPart = urlPartQueryOrFrag
1623 | 	} else if len(s) != eatWhiteSpace(s, 0) && c.urlPart == urlPartNone {
1624 | 		// HTML5 uses "Valid URL potentially surrounded by spaces" for
1625 | 		// attrs: http://www.w3.org/TR/html5/index.html#attributes-1
1626 | 		c.urlPart = urlPartPreQuery
1627 | 	}
1628 | 	return c, len(s)
1629 | }
1630 | 
1631 | // tJS is the context transition function for the JS state.
1632 | func tJS(c context, s []byte) (context, int) {
1633 | 	i := bytes.IndexAny(s, `"'/`)
1634 | 	if i == -1 {
1635 | 		// Entire input is non string, comment, regexp tokens.
1636 | 		c.jsCtx = nextJSCtx(s, c.jsCtx)
1637 | 		return c, len(s)
1638 | 	}
1639 | 	c.jsCtx = nextJSCtx(s[:i], c.jsCtx)
1640 | 	switch s[i] {
1641 | 	case '"':
1642 | 		c.state, c.jsCtx = stateJSDqStr, jsCtxRegexp
1643 | 	case '\'':
1644 | 		c.state, c.jsCtx = stateJSSqStr, jsCtxRegexp
1645 | 	case '/':
1646 | 		switch {
1647 | 		case i+1 < len(s) && s[i+1] == '/':
1648 | 			c.state, i = stateJSLineCmt, i+1
1649 | 		case i+1 < len(s) && s[i+1] == '*':
1650 | 			c.state, i = stateJSBlockCmt, i+1
1651 | 		case c.jsCtx == jsCtxRegexp:
1652 | 			c.state = stateJSRegexp
1653 | 		case c.jsCtx == jsCtxDivOp:
1654 | 			c.jsCtx = jsCtxRegexp
1655 | 		default:
1656 | 			return context{
1657 | 				state: stateError,
1658 | 				err:   errorf(ErrSlashAmbig, 0, "'/' could start a division or regexp: %.32q", s[i:]),
1659 | 			}, len(s)
1660 | 		}
1661 | 	default:
1662 | 		panic("unreachable")
1663 | 	}
1664 | 	return c, i + 1
1665 | }
1666 | 
1667 | // tJSDelimited is the context transition function for the JS string and regexp
1668 | // states.
1669 | func tJSDelimited(c context, s []byte) (context, int) {
1670 | 	specials := `\"`
1671 | 	switch c.state {
1672 | 	case stateJSSqStr:
1673 | 		specials = `\'`
1674 | 	case stateJSRegexp:
1675 | 		specials = `\/[]`
1676 | 	}
1677 | 
1678 | 	k, inCharset := 0, false
1679 | 	for {
1680 | 		i := k + bytes.IndexAny(s[k:], specials)
1681 | 		if i < k {
1682 | 			break
1683 | 		}
1684 | 		switch s[i] {
1685 | 		case '\\':
1686 | 			i++
1687 | 			if i == len(s) {
1688 | 				return context{
1689 | 					state: stateError,
1690 | 					err:   errorf(ErrPartialEscape, 0, "unfinished escape sequence in JS string: %q", s),
1691 | 				}, len(s)
1692 | 			}
1693 | 		case '[':
1694 | 			inCharset = true
1695 | 		case ']':
1696 | 			inCharset = false
1697 | 		default:
1698 | 			// end delimiter
1699 | 			if !inCharset {
1700 | 				c.state, c.jsCtx = stateJS, jsCtxDivOp
1701 | 				return c, i + 1
1702 | 			}
1703 | 		}
1704 | 		k = i + 1
1705 | 	}
1706 | 
1707 | 	if inCharset {
1708 | 		// This can be fixed by making context richer if interpolation
1709 | 		// into charsets is desired.
1710 | 		return context{
1711 | 			state: stateError,
1712 | 			err:   errorf(ErrPartialCharset, 0, "unfinished JS regexp charset: %q", s),
1713 | 		}, len(s)
1714 | 	}
1715 | 
1716 | 	return c, len(s)
1717 | }
1718 | 
1719 | var blockCommentEnd = []byte("*/")
1720 | 
1721 | // tBlockCmt is the context transition function for /*comment*/ states.
1722 | func tBlockCmt(c context, s []byte) (context, int) {
1723 | 	i := bytes.Index(s, blockCommentEnd)
1724 | 	if i == -1 {
1725 | 		return c, len(s)
1726 | 	}
1727 | 	switch c.state {
1728 | 	case stateJSBlockCmt:
1729 | 		c.state = stateJS
1730 | 	case stateCSSBlockCmt:
1731 | 		c.state = stateCSS
1732 | 	default:
1733 | 		panic(c.state.String())
1734 | 	}
1735 | 	return c, i + 2
1736 | }
1737 | 
1738 | // tLineCmt is the context transition function for //comment states.
1739 | func tLineCmt(c context, s []byte) (context, int) {
1740 | 	var lineTerminators string
1741 | 	var endState state
1742 | 	switch c.state {
1743 | 	case stateJSLineCmt:
1744 | 		lineTerminators, endState = "\n\r\u2028\u2029", stateJS
1745 | 	case stateCSSLineCmt:
1746 | 		lineTerminators, endState = "\n\f\r", stateCSS
1747 | 		// Line comments are not part of any published CSS standard but
1748 | 		// are supported by the 4 major browsers.
1749 | 		// This defines line comments as
1750 | 		//     LINECOMMENT ::= "//" [^\n\f\d]*
1751 | 		// since http://www.w3.org/TR/css3-syntax/#SUBTOK-nl defines
1752 | 		// newlines:
1753 | 		//     nl ::= #xA | #xD #xA | #xD | #xC
1754 | 	default:
1755 | 		panic(c.state.String())
1756 | 	}
1757 | 
1758 | 	i := bytes.IndexAny(s, lineTerminators)
1759 | 	if i == -1 {
1760 | 		return c, len(s)
1761 | 	}
1762 | 	c.state = endState
1763 | 	// Per section 7.4 of EcmaScript 5 : http://es5.github.com/#x7.4
1764 | 	// "However, the LineTerminator at the end of the line is not
1765 | 	// considered to be part of the single-line comment; it is
1766 | 	// recognized separately by the lexical grammar and becomes part
1767 | 	// of the stream of input elements for the syntactic grammar."
1768 | 	return c, i
1769 | }
1770 | 
1771 | // tCSS is the context transition function for the CSS state.
1772 | func tCSS(c context, s []byte) (context, int) {
1773 | 	// CSS quoted strings are almost never used except for:
1774 | 	// (1) URLs as in background: "/foo.png"
1775 | 	// (2) Multiword font-names as in font-family: "Times New Roman"
1776 | 	// (3) List separators in content values as in inline-lists:
1777 | 	//    <style>
1778 | 	//    ul.inlineList { list-style: none; padding:0 }
1779 | 	//    ul.inlineList > li { display: inline }
1780 | 	//    ul.inlineList > li:before { content: ", " }
1781 | 	//    ul.inlineList > li:first-child:before { content: "" }
1782 | 	//    </style>
1783 | 	//    <ul class=inlineList><li>One<li>Two<li>Three</ul>
1784 | 	// (4) Attribute value selectors as in a[href="http://example.com/"]
1785 | 	//
1786 | 	// We conservatively treat all strings as URLs, but make some
1787 | 	// allowances to avoid confusion.
1788 | 	//
1789 | 	// In (1), our conservative assumption is justified.
1790 | 	// In (2), valid font names do not contain ':', '?', or '#', so our
1791 | 	// conservative assumption is fine since we will never transition past
1792 | 	// urlPartPreQuery.
1793 | 	// In (3), our protocol heuristic should not be tripped, and there
1794 | 	// should not be non-space content after a '?' or '#', so as long as
1795 | 	// we only %-encode RFC 3986 reserved characters we are ok.
1796 | 	// In (4), we should URL escape for URL attributes, and for others we
1797 | 	// have the attribute name available if our conservative assumption
1798 | 	// proves problematic for real code.
1799 | 
1800 | 	k := 0
1801 | 	for {
1802 | 		i := k + bytes.IndexAny(s[k:], `("'/`)
1803 | 		if i < k {
1804 | 			return c, len(s)
1805 | 		}
1806 | 		switch s[i] {
1807 | 		case '(':
1808 | 			// Look for url to the left.
1809 | 			p := bytes.TrimRight(s[:i], "\t\n\f\r ")
1810 | 			if endsWithCSSKeyword(p, "url") {
1811 | 				j := len(s) - len(bytes.TrimLeft(s[i+1:], "\t\n\f\r "))
1812 | 				switch {
1813 | 				case j != len(s) && s[j] == '"':
1814 | 					c.state, j = stateCSSDqURL, j+1
1815 | 				case j != len(s) && s[j] == '\'':
1816 | 					c.state, j = stateCSSSqURL, j+1
1817 | 				default:
1818 | 					c.state = stateCSSURL
1819 | 				}
1820 | 				return c, j
1821 | 			}
1822 | 		case '/':
1823 | 			if i+1 < len(s) {
1824 | 				switch s[i+1] {
1825 | 				case '/':
1826 | 					c.state = stateCSSLineCmt
1827 | 					return c, i + 2
1828 | 				case '*':
1829 | 					c.state = stateCSSBlockCmt
1830 | 					return c, i + 2
1831 | 				}
1832 | 			}
1833 | 		case '"':
1834 | 			c.state = stateCSSDqStr
1835 | 			return c, i + 1
1836 | 		case '\'':
1837 | 			c.state = stateCSSSqStr
1838 | 			return c, i + 1
1839 | 		}
1840 | 		k = i + 1
1841 | 	}
1842 | }
1843 | 
1844 | // tCSSStr is the context transition function for the CSS string and URL states.
1845 | func tCSSStr(c context, s []byte) (context, int) {
1846 | 	var endAndEsc string
1847 | 	switch c.state {
1848 | 	case stateCSSDqStr, stateCSSDqURL:
1849 | 		endAndEsc = `\"`
1850 | 	case stateCSSSqStr, stateCSSSqURL:
1851 | 		endAndEsc = `\'`
1852 | 	case stateCSSURL:
1853 | 		// Unquoted URLs end with a newline or close parenthesis.
1854 | 		// The below includes the wc (whitespace character) and nl.
1855 | 		endAndEsc = "\\\t\n\f\r )"
1856 | 	default:
1857 | 		panic(c.state.String())
1858 | 	}
1859 | 
1860 | 	k := 0
1861 | 	for {
1862 | 		i := k + bytes.IndexAny(s[k:], endAndEsc)
1863 | 		if i < k {
1864 | 			c, nread := tURL(c, decodeCSS(s[k:]))
1865 | 			return c, k + nread
1866 | 		}
1867 | 		if s[i] == '\\' {
1868 | 			i++
1869 | 			if i == len(s) {
1870 | 				return context{
1871 | 					state: stateError,
1872 | 					err:   errorf(ErrPartialEscape, 0, "unfinished escape sequence in CSS string: %q", s),
1873 | 				}, len(s)
1874 | 			}
1875 | 		} else {
1876 | 			c.state = stateCSS
1877 | 			return c, i + 1
1878 | 		}
1879 | 		c, _ = tURL(c, decodeCSS(s[:i+1]))
1880 | 		k = i + 1
1881 | 	}
1882 | }
1883 | 
1884 | // tError is the context transition function for the error state.
1885 | func tError(c context, s []byte) (context, int) {
1886 | 	return c, len(s)
1887 | }
1888 | 
1889 | // eatAttrName returns the largest j such that s[i:j] is an attribute name.
1890 | // It returns an error if s[i:] does not look like it begins with an
1891 | // attribute name, such as encountering a quote mark without a preceding
1892 | // equals sign.
1893 | func eatAttrName(s []byte, i int) (int, *Error) {
1894 | 	for j := i; j < len(s); j++ {
1895 | 		switch s[j] {
1896 | 		case ' ', '\t', '\n', '\f', '\r', '=', '>':
1897 | 			return j, nil
1898 | 		case '\'', '"', '<':
1899 | 			// These result in a parse warning in HTML5 and are
1900 | 			// indicative of serious problems if seen in an attr
1901 | 			// name in a template.
1902 | 			return -1, errorf(ErrBadHTML, 0, "%q in attribute name: %.32q", s[j:j+1], s)
1903 | 		default:
1904 | 			// No-op.
1905 | 		}
1906 | 	}
1907 | 	return len(s), nil
1908 | }
1909 | 
1910 | var elementNameMap = map[string]element{
1911 | 	"script":   elementScript,
1912 | 	"style":    elementStyle,
1913 | 	"textarea": elementTextarea,
1914 | 	"title":    elementTitle,
1915 | }
1916 | 
1917 | // asciiAlpha reports whether c is an ASCII letter.
1918 | func asciiAlpha(c byte) bool {
1919 | 	return 'A' <= c && c <= 'Z' || 'a' <= c && c <= 'z'
1920 | }
1921 | 
1922 | // asciiAlphaNum reports whether c is an ASCII letter or digit.
1923 | func asciiAlphaNum(c byte) bool {
1924 | 	return asciiAlpha(c) || '0' <= c && c <= '9'
1925 | }
1926 | 
1927 | // eatTagName returns the largest j such that s[i:j] is a tag name and the tag type.
1928 | func eatTagName(s []byte, i int) (int, element) {
1929 | 	if i == len(s) || !asciiAlpha(s[i]) {
1930 | 		return i, elementNone
1931 | 	}
1932 | 	j := i + 1
1933 | 	for j < len(s) {
1934 | 		x := s[j]
1935 | 		if asciiAlphaNum(x) {
1936 | 			j++
1937 | 			continue
1938 | 		}
1939 | 		// Allow "x-y" or "x:y" but not "x-", "-y", or "x--y".
1940 | 		if (x == ':' || x == '-') && j+1 < len(s) && asciiAlphaNum(s[j+1]) {
1941 | 			j += 2
1942 | 			continue
1943 | 		}
1944 | 		break
1945 | 	}
1946 | 	return j, elementNameMap[strings.ToLower(string(s[i:j]))]
1947 | }
1948 | 
1949 | // eatWhiteSpace returns the largest j such that s[i:j] is white space.
1950 | func eatWhiteSpace(s []byte, i int) int {
1951 | 	for j := i; j < len(s); j++ {
1952 | 		switch s[j] {
1953 | 		case ' ', '\t', '\n', '\f', '\r':
1954 | 			// No-op.
1955 | 		default:
1956 | 			return j
1957 | 		}
1958 | 	}
1959 | 	return len(s)
1960 | }
1961 | 
1962 | // Copyright 2011 The Go Authors. All rights reserved.
1963 | // Use of this source code is governed by a BSD-style
1964 | // license that can be found in the LICENSE file.
1965 | 
1966 | // Error describes a problem encountered during template Escaping.
1967 | type Error struct {
1968 | 	// ErrorCode describes the kind of error.
1969 | 	ErrorCode ErrorCode
1970 | 	// Name is the name of the template in which the error was encountered.
1971 | 	Name string
1972 | 	// Line is the line number of the error in the template source or 0.
1973 | 	Line int
1974 | 	// Description is a human-readable description of the problem.
1975 | 	Description string
1976 | }
1977 | 
1978 | // ErrorCode is a code for a kind of error.
1979 | type ErrorCode int
1980 | 
1981 | // We define codes for each error that manifests while escaping templates, but
1982 | // escaped templates may also fail at runtime.
1983 | //
1984 | // Output: "ZgotmplZ"
1985 | // Example:
1986 | //
1987 | //	<img src="{{.X}}">
1988 | //	where {{.X}} evaluates to `javascript:...`
1989 | //
1990 | // Discussion:
1991 | //
1992 | //	"ZgotmplZ" is a special value that indicates that unsafe content reached a
1993 | //	CSS or URL context at runtime. The output of the example will be
1994 | //	  <img src="#ZgotmplZ">
1995 | //	If the data comes from a trusted source, use content types to exempt it
1996 | //	from filtering: URL(`javascript:...`).
1997 | const (
1998 | 	// OK indicates the lack of an error.
1999 | 	OK ErrorCode = iota
2000 | 
2001 | 	// ErrAmbigContext: "... appears in an ambiguous URL context"
2002 | 	// Example:
2003 | 	//   <a href="
2004 | 	//      {{if .C}}
2005 | 	//        /path/
2006 | 	//      {{else}}
2007 | 	//        /search?q=
2008 | 	//      {{end}}
2009 | 	//      {{.X}}
2010 | 	//   ">
2011 | 	// Discussion:
2012 | 	//   {{.X}} is in an ambiguous URL context since, depending on {{.C}},
2013 | 	//  it may be either a URL suffix or a query parameter.
2014 | 	//   Moving {{.X}} into the condition removes the ambiguity:
2015 | 	//   <a href="{{if .C}}/path/{{.X}}{{else}}/search?q={{.X}}">
2016 | 	ErrAmbigContext
2017 | 
2018 | 	// ErrBadHTML: "expected space, attr name, or end of tag, but got ...",
2019 | 	//   "... in unquoted attr", "... in attribute name"
2020 | 	// Example:
2021 | 	//   <a href = /search?q=foo>
2022 | 	//   <href=foo>
2023 | 	//   <form na<e=...>
2024 | 	//   <option selected<
2025 | 	// Discussion:
2026 | 	//   This is often due to a typo in an HTML element, but some runes
2027 | 	//   are banned in tag names, attribute names, and unquoted attribute
2028 | 	//   values because they can tickle parser ambiguities.
2029 | 	//   Quoting all attributes is the best policy.
2030 | 	ErrBadHTML
2031 | 
2032 | 	// ErrBranchEnd: "{{if}} branches end in different contexts"
2033 | 	// Example:
2034 | 	//   {{if .C}}<a href="{{end}}{{.X}}
2035 | 	// Discussion:
2036 | 	//   Package html/template statically examines each path through an
2037 | 	//   {{if}}, {{range}}, or {{with}} to escape any following pipelines.
2038 | 	//   The example is ambiguous since {{.X}} might be an HTML text node,
2039 | 	//   or a URL prefix in an HTML attribute. The context of {{.X}} is
2040 | 	//   used to figure out how to escape it, but that context depends on
2041 | 	//   the run-time value of {{.C}} which is not statically known.
2042 | 	//
2043 | 	//   The problem is usually something like missing quotes or angle
2044 | 	//   brackets, or can be avoided by refactoring to put the two contexts
2045 | 	//   into different branches of an if, range or with. If the problem
2046 | 	//   is in a {{range}} over a collection that should never be empty,
2047 | 	//   adding a dummy {{else}} can help.
2048 | 	ErrBranchEnd
2049 | 
2050 | 	// ErrEndContext: "... ends in a non-text context: ..."
2051 | 	// Examples:
2052 | 	//   <div
2053 | 	//   <div title="no close quote>
2054 | 	//   <script>f()
2055 | 	// Discussion:
2056 | 	//   Executed templates should produce a DocumentFragment of HTML.
2057 | 	//   Templates that end without closing tags will trigger this error.
2058 | 	//   Templates that should not be used in an HTML context or that
2059 | 	//   produce incomplete Fragments should not be executed directly.
2060 | 	//
2061 | 	//   {{define "main"}} <script>{{template "helper"}}</script> {{end}}
2062 | 	//   {{define "helper"}} document.write(' <div title=" ') {{end}}
2063 | 	//
2064 | 	//   "helper" does not produce a valid document fragment, so should
2065 | 	//   not be Executed directly.
2066 | 	ErrEndContext
2067 | 
2068 | 	// ErrNoSuchTemplate: "no such template ..."
2069 | 	// Examples:
2070 | 	//   {{define "main"}}<div {{template "attrs"}}>{{end}}
2071 | 	//   {{define "attrs"}}href="{{.URL}}"{{end}}
2072 | 	// Discussion:
2073 | 	//   Package html/template looks through template calls to compute the
2074 | 	//   context.
2075 | 	//   Here the {{.URL}} in "attrs" must be treated as a URL when called
2076 | 	//   from "main", but you will get this error if "attrs" is not defined
2077 | 	//   when "main" is parsed.
2078 | 	ErrNoSuchTemplate
2079 | 
2080 | 	// ErrOutputContext: "cannot compute output context for template ..."
2081 | 	// Examples:
2082 | 	//   {{define "t"}}{{if .T}}{{template "t" .T}}{{end}}{{.H}}",{{end}}
2083 | 	// Discussion:
2084 | 	//   A recursive template does not end in the same context in which it
2085 | 	//   starts, and a reliable output context cannot be computed.
2086 | 	//   Look for typos in the named template.
2087 | 	//   If the template should not be called in the named start context,
2088 | 	//   look for calls to that template in unexpected contexts.
2089 | 	//   Maybe refactor recursive templates to not be recursive.
2090 | 	ErrOutputContext
2091 | 
2092 | 	// ErrPartialCharset: "unfinished JS regexp charset in ..."
2093 | 	// Example:
2094 | 	//     <script>var pattern = /foo[{{.Chars}}]/</script>
2095 | 	// Discussion:
2096 | 	//   Package html/template does not support interpolation into regular
2097 | 	//   expression literal character sets.
2098 | 	ErrPartialCharset
2099 | 
2100 | 	// ErrPartialEscape: "unfinished escape sequence in ..."
2101 | 	// Example:
2102 | 	//   <script>alert("\{{.X}}")</script>
2103 | 	// Discussion:
2104 | 	//   Package html/template does not support actions following a
2105 | 	//   backslash.
2106 | 	//   This is usually an error and there are better solutions; for
2107 | 	//   example
2108 | 	//     <script>alert("{{.X}}")</script>
2109 | 	//   should work, and if {{.X}} is a partial escape sequence such as
2110 | 	//   "xA0", mark the whole sequence as safe content: JSStr(`\xA0`)
2111 | 	ErrPartialEscape
2112 | 
2113 | 	// ErrRangeLoopReentry: "on range loop re-entry: ..."
2114 | 	// Example:
2115 | 	//   <script>var x = [{{range .}}'{{.}},{{end}}]</script>
2116 | 	// Discussion:
2117 | 	//   If an iteration through a range would cause it to end in a
2118 | 	//   different context than an earlier pass, there is no single context.
2119 | 	//   In the example, there is missing a quote, so it is not clear
2120 | 	//   whether {{.}} is meant to be inside a JS string or in a JS value
2121 | 	//   context.  The second iteration would produce something like
2122 | 	//
2123 | 	//     <script>var x = ['firstValue,'secondValue]</script>
2124 | 	ErrRangeLoopReentry
2125 | 
2126 | 	// ErrSlashAmbig: '/' could start a division or regexp.
2127 | 	// Example:
2128 | 	//   <script>
2129 | 	//     {{if .C}}var x = 1{{end}}
2130 | 	//     /-{{.N}}/i.test(x) ? doThis : doThat();
2131 | 	//   </script>
2132 | 	// Discussion:
2133 | 	//   The example above could produce `var x = 1/-2/i.test(s)...`
2134 | 	//   in which the first '/' is a mathematical division operator or it
2135 | 	//   could produce `/-2/i.test(s)` in which the first '/' starts a
2136 | 	//   regexp literal.
2137 | 	//   Look for missing semicolons inside branches, and maybe add
2138 | 	//   parentheses to make it clear which interpretation you intend.
2139 | 	ErrSlashAmbig
2140 | )
2141 | 
2142 | func (e *Error) Error() string {
2143 | 	if e.Line != 0 {
2144 | 		return fmt.Sprintf("html/template:%s:%d: %s", e.Name, e.Line, e.Description)
2145 | 	} else if e.Name != "" {
2146 | 		return fmt.Sprintf("html/template:%s: %s", e.Name, e.Description)
2147 | 	}
2148 | 	return "html/template: " + e.Description
2149 | }
2150 | 
2151 | // errorf creates an error given a format string f and args.
2152 | // The template Name still needs to be supplied.
2153 | func errorf(k ErrorCode, line int, f string, args ...interface{}) *Error {
2154 | 	return &Error{k, "", line, fmt.Sprintf(f, args...)}
2155 | }
2156 | 
2157 | // Copyright 2011 The Go Authors. All rights reserved.
2158 | // Use of this source code is governed by a BSD-style
2159 | // license that can be found in the LICENSE file.
2160 | 
2161 | // attrTypeMap[n] describes the value of the given attribute.
2162 | // If an attribute affects (or can mask) the encoding or interpretation of
2163 | // other content, or affects the contents, idempotency, or credentials of a
2164 | // network message, then the value in this map is contentTypeUnsafe.
2165 | // This map is derived from HTML5, specifically
2166 | // http://www.w3.org/TR/html5/Overview.html#attributes-1
2167 | // as well as "%URI"-typed attributes from
2168 | // http://www.w3.org/TR/html4/index/attributes.html
2169 | var attrTypeMap = map[string]contentType{
2170 | 	"accept":          contentTypePlain,
2171 | 	"accept-charset":  contentTypeUnsafe,
2172 | 	"action":          contentTypeURL,
2173 | 	"alt":             contentTypePlain,
2174 | 	"archive":         contentTypeURL,
2175 | 	"async":           contentTypeUnsafe,
2176 | 	"autocomplete":    contentTypePlain,
2177 | 	"autofocus":       contentTypePlain,
2178 | 	"autoplay":        contentTypePlain,
2179 | 	"background":      contentTypeURL,
2180 | 	"border":          contentTypePlain,
2181 | 	"checked":         contentTypePlain,
2182 | 	"cite":            contentTypeURL,
2183 | 	"challenge":       contentTypeUnsafe,
2184 | 	"charset":         contentTypeUnsafe,
2185 | 	"class":           contentTypePlain,
2186 | 	"classid":         contentTypeURL,
2187 | 	"codebase":        contentTypeURL,
2188 | 	"cols":            contentTypePlain,
2189 | 	"colspan":         contentTypePlain,
2190 | 	"content":         contentTypeUnsafe,
2191 | 	"contenteditable": contentTypePlain,
2192 | 	"contextmenu":     contentTypePlain,
2193 | 	"controls":        contentTypePlain,
2194 | 	"coords":          contentTypePlain,
2195 | 	"crossorigin":     contentTypeUnsafe,
2196 | 	"data":            contentTypeURL,
2197 | 	"datetime":        contentTypePlain,
2198 | 	"default":         contentTypePlain,
2199 | 	"defer":           contentTypeUnsafe,
2200 | 	"dir":             contentTypePlain,
2201 | 	"dirname":         contentTypePlain,
2202 | 	"disabled":        contentTypePlain,
2203 | 	"draggable":       contentTypePlain,
2204 | 	"dropzone":        contentTypePlain,
2205 | 	"enctype":         contentTypeUnsafe,
2206 | 	"for":             contentTypePlain,
2207 | 	"form":            contentTypeUnsafe,
2208 | 	"formaction":      contentTypeURL,
2209 | 	"formenctype":     contentTypeUnsafe,
2210 | 	"formmethod":      contentTypeUnsafe,
2211 | 	"formnovalidate":  contentTypeUnsafe,
2212 | 	"formtarget":      contentTypePlain,
2213 | 	"headers":         contentTypePlain,
2214 | 	"height":          contentTypePlain,
2215 | 	"hidden":          contentTypePlain,
2216 | 	"high":            contentTypePlain,
2217 | 	"href":            contentTypeURL,
2218 | 	"hreflang":        contentTypePlain,
2219 | 	"http-equiv":      contentTypeUnsafe,
2220 | 	"icon":            contentTypeURL,
2221 | 	"id":              contentTypePlain,
2222 | 	"ismap":           contentTypePlain,
2223 | 	"keytype":         contentTypeUnsafe,
2224 | 	"kind":            contentTypePlain,
2225 | 	"label":           contentTypePlain,
2226 | 	"lang":            contentTypePlain,
2227 | 	"language":        contentTypeUnsafe,
2228 | 	"list":            contentTypePlain,
2229 | 	"longdesc":        contentTypeURL,
2230 | 	"loop":            contentTypePlain,
2231 | 	"low":             contentTypePlain,
2232 | 	"manifest":        contentTypeURL,
2233 | 	"max":             contentTypePlain,
2234 | 	"maxlength":       contentTypePlain,
2235 | 	"media":           contentTypePlain,
2236 | 	"mediagroup":      contentTypePlain,
2237 | 	"method":          contentTypeUnsafe,
2238 | 	"min":             contentTypePlain,
2239 | 	"multiple":        contentTypePlain,
2240 | 	"name":            contentTypePlain,
2241 | 	"novalidate":      contentTypeUnsafe,
2242 | 	// Skip handler names from
2243 | 	// http://www.w3.org/TR/html5/webappapis.html#event-handlers-on-elements,-document-objects,-and-window-objects
2244 | 	// since we have special handling in attrType.
2245 | 	"open":        contentTypePlain,
2246 | 	"optimum":     contentTypePlain,
2247 | 	"pattern":     contentTypeUnsafe,
2248 | 	"placeholder": contentTypePlain,
2249 | 	"poster":      contentTypeURL,
2250 | 	"profile":     contentTypeURL,
2251 | 	"preload":     contentTypePlain,
2252 | 	"pubdate":     contentTypePlain,
2253 | 	"radiogroup":  contentTypePlain,
2254 | 	"readonly":    contentTypePlain,
2255 | 	"rel":         contentTypeUnsafe,
2256 | 	"required":    contentTypePlain,
2257 | 	"reversed":    contentTypePlain,
2258 | 	"rows":        contentTypePlain,
2259 | 	"rowspan":     contentTypePlain,
2260 | 	"sandbox":     contentTypeUnsafe,
2261 | 	"spellcheck":  contentTypePlain,
2262 | 	"scope":       contentTypePlain,
2263 | 	"scoped":      contentTypePlain,
2264 | 	"seamless":    contentTypePlain,
2265 | 	"selected":    contentTypePlain,
2266 | 	"shape":       contentTypePlain,
2267 | 	"size":        contentTypePlain,
2268 | 	"sizes":       contentTypePlain,
2269 | 	"span":        contentTypePlain,
2270 | 	"src":         contentTypeURL,
2271 | 	"srcdoc":      contentTypeHTML,
2272 | 	"srclang":     contentTypePlain,
2273 | 	"start":       contentTypePlain,
2274 | 	"step":        contentTypePlain,
2275 | 	"style":       contentTypeCSS,
2276 | 	"tabindex":    contentTypePlain,
2277 | 	"target":      contentTypePlain,
2278 | 	"title":       contentTypePlain,
2279 | 	"type":        contentTypeUnsafe,
2280 | 	"usemap":      contentTypeURL,
2281 | 	"value":       contentTypeUnsafe,
2282 | 	"width":       contentTypePlain,
2283 | 	"wrap":        contentTypePlain,
2284 | 	"xmlns":       contentTypeURL,
2285 | }
2286 | 
2287 | // attrType returns a conservative (upper-bound on authority) guess at the
2288 | // type of the named attribute.
2289 | func attrType(name string) contentType {
2290 | 	name = strings.ToLower(name)
2291 | 	if strings.HasPrefix(name, "data-") {
2292 | 		// Strip data- so that custom attribute heuristics below are
2293 | 		// widely applied.
2294 | 		// Treat data-action as URL below.
2295 | 		name = name[5:]
2296 | 	} else if colon := strings.IndexRune(name, ':'); colon != -1 {
2297 | 		if name[:colon] == "xmlns" {
2298 | 			return contentTypeURL
2299 | 		}
2300 | 		// Treat svg:href and xlink:href as href below.
2301 | 		name = name[colon+1:]
2302 | 	}
2303 | 	if t, ok := attrTypeMap[name]; ok {
2304 | 		return t
2305 | 	}
2306 | 	// Treat partial event handler names as script.
2307 | 	if strings.HasPrefix(name, "on") {
2308 | 		return contentTypeJS
2309 | 	}
2310 | 
2311 | 	// Heuristics to prevent "javascript:..." injection in custom
2312 | 	// data attributes and custom attributes like g:tweetUrl.
2313 | 	// http://www.w3.org/TR/html5/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes
2314 | 	// "Custom data attributes are intended to store custom data
2315 | 	//  private to the page or application, for which there are no
2316 | 	//  more appropriate attributes or elements."
2317 | 	// Developers seem to store URL content in data URLs that start
2318 | 	// or end with "URI" or "URL".
2319 | 	if strings.Contains(name, "src") ||
2320 | 		strings.Contains(name, "uri") ||
2321 | 		strings.Contains(name, "url") {
2322 | 		return contentTypeURL
2323 | 	}
2324 | 	return contentTypePlain
2325 | }
2326 | 
2327 | // Copyright 2011 The Go Authors. All rights reserved.
2328 | // Use of this source code is governed by a BSD-style
2329 | // license that can be found in the LICENSE file.
2330 | 
2331 | // Strings of content from a trusted source.
2332 | type (
2333 | 	// CSS encapsulates known safe content that matches any of:
2334 | 	//   1. The CSS3 stylesheet production, such as `p { color: purple }`.
2335 | 	//   2. The CSS3 rule production, such as `a[href=~"https:"].foo#bar`.
2336 | 	//   3. CSS3 declaration productions, such as `color: red; margin: 2px`.
2337 | 	//   4. The CSS3 value production, such as `rgba(0, 0, 255, 127)`.
2338 | 	// See http://www.w3.org/TR/css3-syntax/#parsing and
2339 | 	// https://web.archive.org/web/20090211114933/http://w3.org/TR/css3-syntax#style
2340 | 	CSS string
2341 | 
2342 | 	// HTML encapsulates a known safe HTML document fragment.
2343 | 	// It should not be used for HTML from a third-party, or HTML with
2344 | 	// unclosed tags or comments. The outputs of a sound HTML sanitizer
2345 | 	// and a template escaped by this package are fine for use with HTML.
2346 | 	HTML string
2347 | 
2348 | 	// HTMLAttr encapsulates an HTML attribute from a trusted source,
2349 | 	// for example, ` dir="ltr"`.
2350 | 	HTMLAttr string
2351 | 
2352 | 	// JS encapsulates a known safe EcmaScript5 Expression, for example,
2353 | 	// `(x + y * z())`.
2354 | 	// Template authors are responsible for ensuring that typed expressions
2355 | 	// do not break the intended precedence and that there is no
2356 | 	// statement/expression ambiguity as when passing an expression like
2357 | 	// "{ foo: bar() }\n['foo']()", which is both a valid Expression and a
2358 | 	// valid Program with a very different meaning.
2359 | 	JS string
2360 | 
2361 | 	// JSStr encapsulates a sequence of characters meant to be embedded
2362 | 	// between quotes in a JavaScript expression.
2363 | 	// The string must match a series of StringCharacters:
2364 | 	//   StringCharacter :: SourceCharacter but not `\` or LineTerminator
2365 | 	//                    | EscapeSequence
2366 | 	// Note that LineContinuations are not allowed.
2367 | 	// JSStr("foo\\nbar") is fine, but JSStr("foo\\\nbar") is not.
2368 | 	JSStr string
2369 | 
2370 | 	// URL encapsulates a known safe URL or URL substring (see RFC 3986).
2371 | 	// A URL like `javascript:checkThatFormNotEditedBeforeLeavingPage()`
2372 | 	// from a trusted source should go in the page, but by default dynamic
2373 | 	// `javascript:` URLs are filtered out since they are a frequently
2374 | 	// exploited injection vector.
2375 | 	URL string
2376 | )
2377 | 
2378 | type contentType uint8
2379 | 
2380 | const (
2381 | 	contentTypePlain contentType = iota
2382 | 	contentTypeCSS
2383 | 	contentTypeHTML
2384 | 	contentTypeHTMLAttr
2385 | 	contentTypeJS
2386 | 	contentTypeJSStr
2387 | 	contentTypeURL
2388 | 	// contentTypeUnsafe is used in attr.go for values that affect how
2389 | 	// embedded content and network messages are formed, vetted,
2390 | 	// or interpreted; or which credentials network messages carry.
2391 | 	contentTypeUnsafe
2392 | )
2393 | 
2394 | // indirect returns the value, after dereferencing as many times
2395 | // as necessary to reach the base type (or nil).
2396 | func indirect(a interface{}) interface{} {
2397 | 	if a == nil {
2398 | 		return nil
2399 | 	}
2400 | 	if t := reflect.TypeOf(a); t.Kind() != reflect.Ptr {
2401 | 		// Avoid creating a reflect.Value if it's not a pointer.
2402 | 		return a
2403 | 	}
2404 | 	v := reflect.ValueOf(a)
2405 | 	for v.Kind() == reflect.Ptr && !v.IsNil() {
2406 | 		v = v.Elem()
2407 | 	}
2408 | 	return v.Interface()
2409 | }
2410 | 
2411 | var (
2412 | 	errorType       = reflect.TypeOf((*error)(nil)).Elem()
2413 | 	fmtStringerType = reflect.TypeOf((*fmt.Stringer)(nil)).Elem()
2414 | )
2415 | 
2416 | // indirectToStringerOrError returns the value, after dereferencing as many times
2417 | // as necessary to reach the base type (or nil) or an implementation of fmt.Stringer
2418 | // or error,
2419 | func indirectToStringerOrError(a interface{}) interface{} {
2420 | 	if a == nil {
2421 | 		return nil
2422 | 	}
2423 | 	v := reflect.ValueOf(a)
2424 | 	for !v.Type().Implements(fmtStringerType) && !v.Type().Implements(errorType) && v.Kind() == reflect.Ptr && !v.IsNil() {
2425 | 		v = v.Elem()
2426 | 	}
2427 | 	return v.Interface()
2428 | }
2429 | 
2430 | // stringify converts its arguments to a string and the type of the content.
2431 | // All pointers are dereferenced, as in the text/template package.
2432 | func stringify(args ...interface{}) (string, contentType) {
2433 | 	if len(args) == 1 {
2434 | 		switch s := indirect(args[0]).(type) {
2435 | 		case string:
2436 | 			return s, contentTypePlain
2437 | 		case CSS:
2438 | 			return string(s), contentTypeCSS
2439 | 		case HTML:
2440 | 			return string(s), contentTypeHTML
2441 | 		case HTMLAttr:
2442 | 			return string(s), contentTypeHTMLAttr
2443 | 		case JS:
2444 | 			return string(s), contentTypeJS
2445 | 		case JSStr:
2446 | 			return string(s), contentTypeJSStr
2447 | 		case URL:
2448 | 			return string(s), contentTypeURL
2449 | 		}
2450 | 	}
2451 | 	for i, arg := range args {
2452 | 		args[i] = indirectToStringerOrError(arg)
2453 | 	}
2454 | 	return fmt.Sprint(args...), contentTypePlain
2455 | }
2456 | 
2457 | // Copyright 2011 The Go Authors. All rights reserved.
2458 | // Use of this source code is governed by a BSD-style
2459 | // license that can be found in the LICENSE file.
2460 | 
2461 | // endsWithCSSKeyword reports whether b ends with an ident that
2462 | // case-insensitively matches the lower-case kw.
2463 | func endsWithCSSKeyword(b []byte, kw string) bool {
2464 | 	i := len(b) - len(kw)
2465 | 	if i < 0 {
2466 | 		// Too short.
2467 | 		return false
2468 | 	}
2469 | 	if i != 0 {
2470 | 		r, _ := utf8.DecodeLastRune(b[:i])
2471 | 		if isCSSNmchar(r) {
2472 | 			// Too long.
2473 | 			return false
2474 | 		}
2475 | 	}
2476 | 	// Many CSS keywords, such as "!important" can have characters encoded,
2477 | 	// but the URI production does not allow that according to
2478 | 	// http://www.w3.org/TR/css3-syntax/#TOK-URI
2479 | 	// This does not attempt to recognize encoded keywords. For example,
2480 | 	// given "\75\72\6c" and "url" this return false.
2481 | 	return string(bytes.ToLower(b[i:])) == kw
2482 | }
2483 | 
2484 | // isCSSNmchar reports whether rune is allowed anywhere in a CSS identifier.
2485 | func isCSSNmchar(r rune) bool {
2486 | 	// Based on the CSS3 nmchar production but ignores multi-rune escape
2487 | 	// sequences.
2488 | 	// http://www.w3.org/TR/css3-syntax/#SUBTOK-nmchar
2489 | 	return 'a' <= r && r <= 'z' ||
2490 | 		'A' <= r && r <= 'Z' ||
2491 | 		'0' <= r && r <= '9' ||
2492 | 		r == '-' ||
2493 | 		r == '_' ||
2494 | 		// Non-ASCII cases below.
2495 | 		0x80 <= r && r <= 0xd7ff ||
2496 | 		0xe000 <= r && r <= 0xfffd ||
2497 | 		0x10000 <= r && r <= 0x10ffff
2498 | }
2499 | 
2500 | // decodeCSS decodes CSS3 escapes given a sequence of stringchars.
2501 | // If there is no change, it returns the input, otherwise it returns a slice
2502 | // backed by a new array.
2503 | // http://www.w3.org/TR/css3-syntax/#SUBTOK-stringchar defines stringchar.
2504 | func decodeCSS(s []byte) []byte {
2505 | 	i := bytes.IndexByte(s, '\\')
2506 | 	if i == -1 {
2507 | 		return s
2508 | 	}
2509 | 	// The UTF-8 sequence for a codepoint is never longer than 1 + the
2510 | 	// number hex digits need to represent that codepoint, so len(s) is an
2511 | 	// upper bound on the output length.
2512 | 	b := make([]byte, 0, len(s))
2513 | 	for len(s) != 0 {
2514 | 		i := bytes.IndexByte(s, '\\')
2515 | 		if i == -1 {
2516 | 			i = len(s)
2517 | 		}
2518 | 		b, s = append(b, s[:i]...), s[i:]
2519 | 		if len(s) < 2 {
2520 | 			break
2521 | 		}
2522 | 		// http://www.w3.org/TR/css3-syntax/#SUBTOK-escape
2523 | 		// escape ::= unicode | '\' [#x20-#x7E#x80-#xD7FF#xE000-#xFFFD#x10000-#x10FFFF]
2524 | 		if isHex(s[1]) {
2525 | 			// http://www.w3.org/TR/css3-syntax/#SUBTOK-unicode
2526 | 			//   unicode ::= '\' [0-9a-fA-F]{1,6} wc?
2527 | 			j := 2
2528 | 			for j < len(s) && j < 7 && isHex(s[j]) {
2529 | 				j++
2530 | 			}
2531 | 			r := hexDecode(s[1:j])
2532 | 			if r > unicode.MaxRune {
2533 | 				r, j = r/16, j-1
2534 | 			}
2535 | 			n := utf8.EncodeRune(b[len(b):cap(b)], r)
2536 | 			// The optional space at the end allows a hex
2537 | 			// sequence to be followed by a literal hex.
2538 | 			// string(decodeCSS([]byte(`\A B`))) == "\nB"
2539 | 			b, s = b[:len(b)+n], skipCSSSpace(s[j:])
2540 | 		} else {
2541 | 			// `\\` decodes to `\` and `\"` to `"`.
2542 | 			_, n := utf8.DecodeRune(s[1:])
2543 | 			b, s = append(b, s[1:1+n]...), s[1+n:]
2544 | 		}
2545 | 	}
2546 | 	return b
2547 | }
2548 | 
2549 | // isHex reports whether the given character is a hex digit.
2550 | func isHex(c byte) bool {
2551 | 	return '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F'
2552 | }
2553 | 
2554 | // hexDecode decodes a short hex digit sequence: "10" -> 16.
2555 | func hexDecode(s []byte) rune {
2556 | 	n := '\x00'
2557 | 	for _, c := range s {
2558 | 		n <<= 4
2559 | 		switch {
2560 | 		case '0' <= c && c <= '9':
2561 | 			n |= rune(c - '0')
2562 | 		case 'a' <= c && c <= 'f':
2563 | 			n |= rune(c-'a') + 10
2564 | 		case 'A' <= c && c <= 'F':
2565 | 			n |= rune(c-'A') + 10
2566 | 		default:
2567 | 			panic(fmt.Sprintf("Bad hex digit in %q", s))
2568 | 		}
2569 | 	}
2570 | 	return n
2571 | }
2572 | 
2573 | // skipCSSSpace returns a suffix of c, skipping over a single space.
2574 | func skipCSSSpace(c []byte) []byte {
2575 | 	if len(c) == 0 {
2576 | 		return c
2577 | 	}
2578 | 	// wc ::= #x9 | #xA | #xC | #xD | #x20
2579 | 	switch c[0] {
2580 | 	case '\t', '\n', '\f', ' ':
2581 | 		return c[1:]
2582 | 	case '\r':
2583 | 		// This differs from CSS3's wc production because it contains a
2584 | 		// probable spec error whereby wc contains all the single byte
2585 | 		// sequences in nl (newline) but not CRLF.
2586 | 		if len(c) >= 2 && c[1] == '\n' {
2587 | 			return c[2:]
2588 | 		}
2589 | 		return c[1:]
2590 | 	}
2591 | 	return c
2592 | }
2593 | 
2594 | // isCSSSpace reports whether b is a CSS space char as defined in wc.
2595 | func isCSSSpace(b byte) bool {
2596 | 	switch b {
2597 | 	case '\t', '\n', '\f', '\r', ' ':
2598 | 		return true
2599 | 	}
2600 | 	return false
2601 | }
2602 | 
2603 | // cssEscaper escapes HTML and CSS special characters using \<hex>+ escapes.
2604 | func cssEscaper(args ...interface{}) string {
2605 | 	s, _ := stringify(args...)
2606 | 	var b bytes.Buffer
2607 | 	written := 0
2608 | 	for i, r := range s {
2609 | 		var repl string
2610 | 		switch r {
2611 | 		case 0:
2612 | 			repl = `\0`
2613 | 		case '\t':
2614 | 			repl = `\9`
2615 | 		case '\n':
2616 | 			repl = `\a`
2617 | 		case '\f':
2618 | 			repl = `\c`
2619 | 		case '\r':
2620 | 			repl = `\d`
2621 | 		// Encode HTML specials as hex so the output can be embedded
2622 | 		// in HTML attributes without further encoding.
2623 | 		case '"':
2624 | 			repl = `\22`
2625 | 		case '&':
2626 | 			repl = `\26`
2627 | 		case '\'':
2628 | 			repl = `\27`
2629 | 		case '(':
2630 | 			repl = `\28`
2631 | 		case ')':
2632 | 			repl = `\29`
2633 | 		case '+':
2634 | 			repl = `\2b`
2635 | 		case '/':
2636 | 			repl = `\2f`
2637 | 		case ':':
2638 | 			repl = `\3a`
2639 | 		case ';':
2640 | 			repl = `\3b`
2641 | 		case '<':
2642 | 			repl = `\3c`
2643 | 		case '>':
2644 | 			repl = `\3e`
2645 | 		case '\\':
2646 | 			repl = `\\`
2647 | 		case '{':
2648 | 			repl = `\7b`
2649 | 		case '}':
2650 | 			repl = `\7d`
2651 | 		default:
2652 | 			continue
2653 | 		}
2654 | 		b.WriteString(s[written:i])
2655 | 		b.WriteString(repl)
2656 | 		written = i + utf8.RuneLen(r)
2657 | 		if repl != `\\` && (written == len(s) || isHex(s[written]) || isCSSSpace(s[written])) {
2658 | 			b.WriteByte(' ')
2659 | 		}
2660 | 	}
2661 | 	if written == 0 {
2662 | 		return s
2663 | 	}
2664 | 	b.WriteString(s[written:])
2665 | 	return b.String()
2666 | }
2667 | 
2668 | var expressionBytes = []byte("expression")
2669 | var mozBindingBytes = []byte("mozbinding")
2670 | 
2671 | // cssValueFilter allows innocuous CSS values in the output including CSS
2672 | // quantities (10px or 25%), ID or class literals (#foo, .bar), keyword values
2673 | // (inherit, blue), and colors (#888).
2674 | // It filters out unsafe values, such as those that affect token boundaries,
2675 | // and anything that might execute scripts.
2676 | func cssValueFilter(args ...interface{}) string {
2677 | 	s, t := stringify(args...)
2678 | 	if t == contentTypeCSS {
2679 | 		return s
2680 | 	}
2681 | 	b, id := decodeCSS([]byte(s)), make([]byte, 0, 64)
2682 | 
2683 | 	// CSS3 error handling is specified as honoring string boundaries per
2684 | 	// http://www.w3.org/TR/css3-syntax/#error-handling :
2685 | 	//     Malformed declarations. User agents must handle unexpected
2686 | 	//     tokens encountered while parsing a declaration by reading until
2687 | 	//     the end of the declaration, while observing the rules for
2688 | 	//     matching pairs of (), [], {}, "", and '', and correctly handling
2689 | 	//     escapes. For example, a malformed declaration may be missing a
2690 | 	//     property, colon (:) or value.
2691 | 	// So we need to make sure that values do not have mismatched bracket
2692 | 	// or quote characters to prevent the browser from restarting parsing
2693 | 	// inside a string that might embed JavaScript source.
2694 | 	for i, c := range b {
2695 | 		switch c {
2696 | 		case 0, '"', '\'', '(', ')', '/', ';', '@', '[', '\\', ']', '`', '{', '}':
2697 | 			return filterFailsafe
2698 | 		case '-':
2699 | 			// Disallow <!-- or -->.
2700 | 			// -- should not appear in valid identifiers.
2701 | 			if i != 0 && b[i-1] == '-' {
2702 | 				return filterFailsafe
2703 | 			}
2704 | 		default:
2705 | 			if c < 0x80 && isCSSNmchar(rune(c)) {
2706 | 				id = append(id, c)
2707 | 			}
2708 | 		}
2709 | 	}
2710 | 	id = bytes.ToLower(id)
2711 | 	if bytes.Index(id, expressionBytes) != -1 || bytes.Index(id, mozBindingBytes) != -1 {
2712 | 		return filterFailsafe
2713 | 	}
2714 | 	return string(b)
2715 | }
2716 | 
2717 | // Copyright 2011 The Go Authors. All rights reserved.
2718 | // Use of this source code is governed by a BSD-style
2719 | // license that can be found in the LICENSE file.
2720 | 
2721 | /*
2722 | Package template (html/template) implements data-driven templates for
2723 | generating HTML output safe against code injection. It provides the
2724 | same interface as package text/template and should be used instead of
2725 | text/template whenever the output is HTML.
2726 | 
2727 | The documentation here focuses on the security features of the package.
2728 | For information about how to program the templates themselves, see the
2729 | documentation for text/template.
2730 | 
2731 | Introduction
2732 | 
2733 | This package wraps package text/template so you can share its template API
2734 | to parse and execute HTML templates safely.
2735 | 
2736 |   tmpl, err := template.New("name").Parse(...)
2737 |   // Error checking elided
2738 |   err = tmpl.Execute(out, data)
2739 | 
2740 | If successful, tmpl will now be injection-safe. Otherwise, err is an error
2741 | defined in the docs for ErrorCode.
2742 | 
2743 | HTML templates treat data values as plain text which should be encoded so they
2744 | can be safely embedded in an HTML document. The escaping is contextual, so
2745 | actions can appear within JavaScript, CSS, and URI contexts.
2746 | 
2747 | The security model used by this package assumes that template authors are
2748 | trusted, while Execute's data parameter is not. More details are
2749 | provided below.
2750 | 
2751 | Example
2752 | 
2753 |   import "text/template"
2754 |   ...
2755 |   t, err := template.New("foo").Parse(`{{define "T"}}Hello, {{.}}!{{end}}`)
2756 |   err = t.ExecuteTemplate(out, "T", "<script>alert('you have been pwned')</script>")
2757 | 
2758 | produces
2759 | 
2760 |   Hello, <script>alert('you have been pwned')</script>!
2761 | 
2762 | but the contextual autoescaping in html/template
2763 | 
2764 |   import "html/template"
2765 |   ...
2766 |   t, err := template.New("foo").Parse(`{{define "T"}}Hello, {{.}}!{{end}}`)
2767 |   err = t.ExecuteTemplate(out, "T", "<script>alert('you have been pwned')</script>")
2768 | 
2769 | produces safe, escaped HTML output
2770 | 
2771 |   Hello, &lt;script&gt;alert(&#39;you have been pwned&#39;)&lt;/script&gt;!
2772 | 
2773 | 
2774 | Contexts
2775 | 
2776 | This package understands HTML, CSS, JavaScript, and URIs. It adds sanitizing
2777 | functions to each simple action pipeline, so given the excerpt
2778 | 
2779 |   <a href="/search?q={{.}}">{{.}}</a>
2780 | 
2781 | At parse time each {{.}} is overwritten to add escaping functions as necessary.
2782 | In this case it becomes
2783 | 
2784 |   <a href="/search?q={{. | urlquery}}">{{. | html}}</a>
2785 | 
2786 | 
2787 | Errors
2788 | 
2789 | See the documentation of ErrorCode for details.
2790 | 
2791 | 
2792 | A fuller picture
2793 | 
2794 | The rest of this package comment may be skipped on first reading; it includes
2795 | details necessary to understand escaping contexts and error messages. Most users
2796 | will not need to understand these details.
2797 | 
2798 | 
2799 | Contexts
2800 | 
2801 | Assuming {{.}} is `O'Reilly: How are <i>you</i>?`, the table below shows
2802 | how {{.}} appears when used in the context to the left.
2803 | 
2804 |   Context                          {{.}} After
2805 |   {{.}}                            O'Reilly: How are &lt;i&gt;you&lt;/i&gt;?
2806 |   <a title='{{.}}'>                O&#39;Reilly: How are you?
2807 |   <a href="/{{.}}">                O&#39;Reilly: How are %3ci%3eyou%3c/i%3e?
2808 |   <a href="?q={{.}}">              O&#39;Reilly%3a%20How%20are%3ci%3e...%3f
2809 |   <a onx='f("{{.}}")'>             O\x27Reilly: How are \x3ci\x3eyou...?
2810 |   <a onx='f({{.}})'>               "O\x27Reilly: How are \x3ci\x3eyou...?"
2811 |   <a onx='pattern = /{{.}}/;'>     O\x27Reilly: How are \x3ci\x3eyou...\x3f
2812 | 
2813 | If used in an unsafe context, then the value might be filtered out:
2814 | 
2815 |   Context                          {{.}} After
2816 |   <a href="{{.}}">                 #ZgotmplZ
2817 | 
2818 | since "O'Reilly:" is not an allowed protocol like "http:".
2819 | 
2820 | 
2821 | If {{.}} is the innocuous word, `left`, then it can appear more widely,
2822 | 
2823 |   Context                              {{.}} After
2824 |   {{.}}                                left
2825 |   <a title='{{.}}'>                    left
2826 |   <a href='{{.}}'>                     left
2827 |   <a href='/{{.}}'>                    left
2828 |   <a href='?dir={{.}}'>                left
2829 |   <a style="border-{{.}}: 4px">        left
2830 |   <a style="align: {{.}}">             left
2831 |   <a style="background: '{{.}}'>       left
2832 |   <a style="background: url('{{.}}')>  left
2833 |   <style>p.{{.}} {color:red}</style>   left
2834 | 
2835 | Non-string values can be used in JavaScript contexts.
2836 | If {{.}} is
2837 | 
2838 |   struct{A,B string}{ "foo", "bar" }
2839 | 
2840 | in the escaped template
2841 | 
2842 |   <script>var pair = {{.}};</script>
2843 | 
2844 | then the template output is
2845 | 
2846 |   <script>var pair = {"A": "foo", "B": "bar"};</script>
2847 | 
2848 | See package json to understand how non-string content is marshalled for
2849 | embedding in JavaScript contexts.
2850 | 
2851 | 
2852 | Typed Strings
2853 | 
2854 | By default, this package assumes that all pipelines produce a plain text string.
2855 | It adds escaping pipeline stages necessary to correctly and safely embed that
2856 | plain text string in the appropriate context.
2857 | 
2858 | When a data value is not plain text, you can make sure it is not over-escaped
2859 | by marking it with its type.
2860 | 
2861 | Types HTML, JS, URL, and others from content.go can carry safe content that is
2862 | exempted from escaping.
2863 | 
2864 | The template
2865 | 
2866 |   Hello, {{.}}!
2867 | 
2868 | can be invoked with
2869 | 
2870 |   tmpl.Execute(out, HTML(`<b>World</b>`))
2871 | 
2872 | to produce
2873 | 
2874 |   Hello, <b>World</b>!
2875 | 
2876 | instead of the
2877 | 
2878 |   Hello, &lt;b&gt;World&lt;b&gt;!
2879 | 
2880 | that would have been produced if {{.}} was a regular string.
2881 | 
2882 | 
2883 | Security Model
2884 | 
2885 | http://js-quasis-libraries-and-repl.googlecode.com/svn/trunk/safetemplate.html#problem_definition defines "safe" as used by this package.
2886 | 
2887 | This package assumes that template authors are trusted, that Execute's data
2888 | parameter is not, and seeks to preserve the properties below in the face
2889 | of untrusted data:
2890 | 
2891 | Structure Preservation Property:
2892 | "... when a template author writes an HTML tag in a safe templating language,
2893 | the browser will interpret the corresponding portion of the output as a tag
2894 | regardless of the values of untrusted data, and similarly for other structures
2895 | such as attribute boundaries and JS and CSS string boundaries."
2896 | 
2897 | Code Effect Property:
2898 | "... only code specified by the template author should run as a result of
2899 | injecting the template output into a page and all code specified by the
2900 | template author should run as a result of the same."
2901 | 
2902 | Least Surprise Property:
2903 | "A developer (or code reviewer) familiar with HTML, CSS, and JavaScript, who
2904 | knows that contextual autoescaping happens should be able to look at a {{.}}
2905 | and correctly infer what sanitization happens."
2906 | */
2907 | // Copyright 2011 The Go Authors. All rights reserved.
2908 | // Use of this source code is governed by a BSD-style
2909 | // license that can be found in the LICENSE file.
2910 | 
2911 | // nextJSCtx returns the context that determines whether a slash after the
2912 | // given run of tokens starts a regular expression instead of a division
2913 | // operator: / or /=.
2914 | //
2915 | // This assumes that the token run does not include any string tokens, comment
2916 | // tokens, regular expression literal tokens, or division operators.
2917 | //
2918 | // This fails on some valid but nonsensical JavaScript programs like
2919 | // "x = ++/foo/i" which is quite different than "x++/foo/i", but is not known to
2920 | // fail on any known useful programs. It is based on the draft
2921 | // JavaScript 2.0 lexical grammar and requires one token of lookbehind:
2922 | // http://www.mozilla.org/js/language/js20-2000-07/rationale/syntax.html
2923 | func nextJSCtx(s []byte, preceding jsCtx) jsCtx {
2924 | 	s = bytes.TrimRight(s, "\t\n\f\r \u2028\u2029")
2925 | 	if len(s) == 0 {
2926 | 		return preceding
2927 | 	}
2928 | 
2929 | 	// All cases below are in the single-byte UTF-8 group.
2930 | 	switch c, n := s[len(s)-1], len(s); c {
2931 | 	case '+', '-':
2932 | 		// ++ and -- are not regexp preceders, but + and - are whether
2933 | 		// they are used as infix or prefix operators.
2934 | 		start := n - 1
2935 | 		// Count the number of adjacent dashes or pluses.
2936 | 		for start > 0 && s[start-1] == c {
2937 | 			start--
2938 | 		}
2939 | 		if (n-start)&1 == 1 {
2940 | 			// Reached for trailing minus signs since "---" is the
2941 | 			// same as "-- -".
2942 | 			return jsCtxRegexp
2943 | 		}
2944 | 		return jsCtxDivOp
2945 | 	case '.':
2946 | 		// Handle "42."
2947 | 		if n != 1 && '0' <= s[n-2] && s[n-2] <= '9' {
2948 | 			return jsCtxDivOp
2949 | 		}
2950 | 		return jsCtxRegexp
2951 | 	// Suffixes for all punctuators from section 7.7 of the language spec
2952 | 	// that only end binary operators not handled above.
2953 | 	case ',', '<', '>', '=', '*', '%', '&', '|', '^', '?':
2954 | 		return jsCtxRegexp
2955 | 	// Suffixes for all punctuators from section 7.7 of the language spec
2956 | 	// that are prefix operators not handled above.
2957 | 	case '!', '~':
2958 | 		return jsCtxRegexp
2959 | 	// Matches all the punctuators from section 7.7 of the language spec
2960 | 	// that are open brackets not handled above.
2961 | 	case '(', '[':
2962 | 		return jsCtxRegexp
2963 | 	// Matches all the punctuators from section 7.7 of the language spec
2964 | 	// that precede expression starts.
2965 | 	case ':', ';', '{':
2966 | 		return jsCtxRegexp
2967 | 	// CAVEAT: the close punctuators ('}', ']', ')') precede div ops and
2968 | 	// are handled in the default except for '}' which can precede a
2969 | 	// division op as in
2970 | 	//    ({ valueOf: function () { return 42 } } / 2
2971 | 	// which is valid, but, in practice, developers don't divide object
2972 | 	// literals, so our heuristic works well for code like
2973 | 	//    function () { ... }  /foo/.test(x) && sideEffect();
2974 | 	// The ')' punctuator can precede a regular expression as in
2975 | 	//     if (b) /foo/.test(x) && ...
2976 | 	// but this is much less likely than
2977 | 	//     (a + b) / c
2978 | 	case '}':
2979 | 		return jsCtxRegexp
2980 | 	default:
2981 | 		// Look for an IdentifierName and see if it is a keyword that
2982 | 		// can precede a regular expression.
2983 | 		j := n
2984 | 		for j > 0 && isJSIdentPart(rune(s[j-1])) {
2985 | 			j--
2986 | 		}
2987 | 		if regexpPrecederKeywords[string(s[j:])] {
2988 | 			return jsCtxRegexp
2989 | 		}
2990 | 	}
2991 | 	// Otherwise is a punctuator not listed above, or
2992 | 	// a string which precedes a div op, or an identifier
2993 | 	// which precedes a div op.
2994 | 	return jsCtxDivOp
2995 | }
2996 | 
2997 | // regexpPrecederKeywords is a set of reserved JS keywords that can precede a
2998 | // regular expression in JS source.
2999 | var regexpPrecederKeywords = map[string]bool{
3000 | 	"break":      true,
3001 | 	"case":       true,
3002 | 	"continue":   true,
3003 | 	"delete":     true,
3004 | 	"do":         true,
3005 | 	"else":       true,
3006 | 	"finally":    true,
3007 | 	"in":         true,
3008 | 	"instanceof": true,
3009 | 	"return":     true,
3010 | 	"throw":      true,
3011 | 	"try":        true,
3012 | 	"typeof":     true,
3013 | 	"void":       true,
3014 | }
3015 | 
3016 | var jsonMarshalType = reflect.TypeOf((*json.Marshaler)(nil)).Elem()
3017 | 
3018 | // indirectToJSONMarshaler returns the value, after dereferencing as many times
3019 | // as necessary to reach the base type (or nil) or an implementation of json.Marshal.
3020 | func indirectToJSONMarshaler(a interface{}) interface{} {
3021 | 	v := reflect.ValueOf(a)
3022 | 	for !v.Type().Implements(jsonMarshalType) && v.Kind() == reflect.Ptr && !v.IsNil() {
3023 | 		v = v.Elem()
3024 | 	}
3025 | 	return v.Interface()
3026 | }
3027 | 
3028 | // jsValEscaper escapes its inputs to a JS Expression (section 11.14) that has
3029 | // neither side-effects nor free variables outside (NaN, Infinity).
3030 | func jsValEscaper(args ...interface{}) string {
3031 | 	var a interface{}
3032 | 	if len(args) == 1 {
3033 | 		a = indirectToJSONMarshaler(args[0])
3034 | 		switch t := a.(type) {
3035 | 		case JS:
3036 | 			return string(t)
3037 | 		case JSStr:
3038 | 			// TODO: normalize quotes.
3039 | 			return `"` + string(t) + `"`
3040 | 		case json.Marshaler:
3041 | 			// Do not treat as a Stringer.
3042 | 		case fmt.Stringer:
3043 | 			a = t.String()
3044 | 		}
3045 | 	} else {
3046 | 		for i, arg := range args {
3047 | 			args[i] = indirectToJSONMarshaler(arg)
3048 | 		}
3049 | 		a = fmt.Sprint(args...)
3050 | 	}
3051 | 	// TODO: detect cycles before calling Marshal which loops infinitely on
3052 | 	// cyclic data. This may be an unacceptable DoS risk.
3053 | 
3054 | 	b, err := json.Marshal(a)
3055 | 	if err != nil {
3056 | 		// Put a space before comment so that if it is flush against
3057 | 		// a division operator it is not turned into a line comment:
3058 | 		//     x/{{y}}
3059 | 		// turning into
3060 | 		//     x//* error marshalling y:
3061 | 		//          second line of error message */null
3062 | 		return fmt.Sprintf(" /* %s */null ", strings.Replace(err.Error(), "*/", "* /", -1))
3063 | 	}
3064 | 
3065 | 	// TODO: maybe post-process output to prevent it from containing
3066 | 	// "<!--", "-->", "<![CDATA[", "]]>", or "</script"
3067 | 	// in case custom marshallers produce output containing those.
3068 | 
3069 | 	// TODO: Maybe abbreviate \u00ab to \xab to produce more compact output.
3070 | 	if len(b) == 0 {
3071 | 		// In, `x=y/{{.}}*z` a json.Marshaler that produces "" should
3072 | 		// not cause the output `x=y/*z`.
3073 | 		return " null "
3074 | 	}
3075 | 	first, _ := utf8.DecodeRune(b)
3076 | 	last, _ := utf8.DecodeLastRune(b)
3077 | 	var buf bytes.Buffer
3078 | 	// Prevent IdentifierNames and NumericLiterals from running into
3079 | 	// keywords: in, instanceof, typeof, void
3080 | 	pad := isJSIdentPart(first) || isJSIdentPart(last)
3081 | 	if pad {
3082 | 		buf.WriteByte(' ')
3083 | 	}
3084 | 	written := 0
3085 | 	// Make sure that json.Marshal escapes codepoints U+2028 & U+2029
3086 | 	// so it falls within the subset of JSON which is valid JS.
3087 | 	for i := 0; i < len(b); {
3088 | 		rune, n := utf8.DecodeRune(b[i:])
3089 | 		repl := ""
3090 | 		if rune == 0x2028 {
3091 | 			repl = `\u2028`
3092 | 		} else if rune == 0x2029 {
3093 | 			repl = `\u2029`
3094 | 		}
3095 | 		if repl != "" {
3096 | 			buf.Write(b[written:i])
3097 | 			buf.WriteString(repl)
3098 | 			written = i + n
3099 | 		}
3100 | 		i += n
3101 | 	}
3102 | 	if buf.Len() != 0 {
3103 | 		buf.Write(b[written:])
3104 | 		if pad {
3105 | 			buf.WriteByte(' ')
3106 | 		}
3107 | 		b = buf.Bytes()
3108 | 	}
3109 | 	return string(b)
3110 | }
3111 | 
3112 | // jsStrEscaper produces a string that can be included between quotes in
3113 | // JavaScript source, in JavaScript embedded in an HTML5 <script> element,
3114 | // or in an HTML5 event handler attribute such as onclick.
3115 | func jsStrEscaper(args ...interface{}) string {
3116 | 	s, t := stringify(args...)
3117 | 	if t == contentTypeJSStr {
3118 | 		return replace(s, jsStrNormReplacementTable)
3119 | 	}
3120 | 	return replace(s, jsStrReplacementTable)
3121 | }
3122 | 
3123 | // jsRegexpEscaper behaves like jsStrEscaper but escapes regular expression
3124 | // specials so the result is treated literally when included in a regular
3125 | // expression literal. /foo{{.X}}bar/ matches the string "foo" followed by
3126 | // the literal text of {{.X}} followed by the string "bar".
3127 | func jsRegexpEscaper(args ...interface{}) string {
3128 | 	s, _ := stringify(args...)
3129 | 	s = replace(s, jsRegexpReplacementTable)
3130 | 	if s == "" {
3131 | 		// /{{.X}}/ should not produce a line comment when .X == "".
3132 | 		return "(?:)"
3133 | 	}
3134 | 	return s
3135 | }
3136 | 
3137 | // replace replaces each rune r of s with replacementTable[r], provided that
3138 | // r < len(replacementTable). If replacementTable[r] is the empty string then
3139 | // no replacement is made.
3140 | // It also replaces runes U+2028 and U+2029 with the raw strings `\u2028` and
3141 | // `\u2029`.
3142 | func replace(s string, replacementTable []string) string {
3143 | 	var b bytes.Buffer
3144 | 	written := 0
3145 | 	for i, r := range s {
3146 | 		var repl string
3147 | 		switch {
3148 | 		case int(r) < len(replacementTable) && replacementTable[r] != "":
3149 | 			repl = replacementTable[r]
3150 | 		case r == '\u2028':
3151 | 			repl = `\u2028`
3152 | 		case r == '\u2029':
3153 | 			repl = `\u2029`
3154 | 		default:
3155 | 			continue
3156 | 		}
3157 | 		b.WriteString(s[written:i])
3158 | 		b.WriteString(repl)
3159 | 		written = i + utf8.RuneLen(r)
3160 | 	}
3161 | 	if written == 0 {
3162 | 		return s
3163 | 	}
3164 | 	b.WriteString(s[written:])
3165 | 	return b.String()
3166 | }
3167 | 
3168 | var jsStrReplacementTable = []string{
3169 | 	0:    `\0`,
3170 | 	'\t': `\t`,
3171 | 	'\n': `\n`,
3172 | 	'\v': `\x0b`, // "\v" == "v" on IE 6.
3173 | 	'\f': `\f`,
3174 | 	'\r': `\r`,
3175 | 	// Encode HTML specials as hex so the output can be embedded
3176 | 	// in HTML attributes without further encoding.
3177 | 	'"':  `\x22`,
3178 | 	'&':  `\x26`,
3179 | 	'\'': `\x27`,
3180 | 	'+':  `\x2b`,
3181 | 	'/':  `\/`,
3182 | 	'<':  `\x3c`,
3183 | 	'>':  `\x3e`,
3184 | 	'\\': `\\`,
3185 | }
3186 | 
3187 | // jsStrNormReplacementTable is like jsStrReplacementTable but does not
3188 | // overencode existing escapes since this table has no entry for `\`.
3189 | var jsStrNormReplacementTable = []string{
3190 | 	0:    `\0`,
3191 | 	'\t': `\t`,
3192 | 	'\n': `\n`,
3193 | 	'\v': `\x0b`, // "\v" == "v" on IE 6.
3194 | 	'\f': `\f`,
3195 | 	'\r': `\r`,
3196 | 	// Encode HTML specials as hex so the output can be embedded
3197 | 	// in HTML attributes without further encoding.
3198 | 	'"':  `\x22`,
3199 | 	'&':  `\x26`,
3200 | 	'\'': `\x27`,
3201 | 	'+':  `\x2b`,
3202 | 	'/':  `\/`,
3203 | 	'<':  `\x3c`,
3204 | 	'>':  `\x3e`,
3205 | }
3206 | 
3207 | var jsRegexpReplacementTable = []string{
3208 | 	0:    `\0`,
3209 | 	'\t': `\t`,
3210 | 	'\n': `\n`,
3211 | 	'\v': `\x0b`, // "\v" == "v" on IE 6.
3212 | 	'\f': `\f`,
3213 | 	'\r': `\r`,
3214 | 	// Encode HTML specials as hex so the output can be embedded
3215 | 	// in HTML attributes without further encoding.
3216 | 	'"':  `\x22`,
3217 | 	'$':  `\$`,
3218 | 	'&':  `\x26`,
3219 | 	'\'': `\x27`,
3220 | 	'(':  `\(`,
3221 | 	')':  `\)`,
3222 | 	'*':  `\*`,
3223 | 	'+':  `\x2b`,
3224 | 	'-':  `\-`,
3225 | 	'.':  `\.`,
3226 | 	'/':  `\/`,
3227 | 	'<':  `\x3c`,
3228 | 	'>':  `\x3e`,
3229 | 	'?':  `\?`,
3230 | 	'[':  `\[`,
3231 | 	'\\': `\\`,
3232 | 	']':  `\]`,
3233 | 	'^':  `\^`,
3234 | 	'{':  `\{`,
3235 | 	'|':  `\|`,
3236 | 	'}':  `\}`,
3237 | }
3238 | 
3239 | // isJSIdentPart reports whether the given rune is a JS identifier part.
3240 | // It does not handle all the non-Latin letters, joiners, and combining marks,
3241 | // but it does handle every codepoint that can occur in a numeric literal or
3242 | // a keyword.
3243 | func isJSIdentPart(r rune) bool {
3244 | 	switch {
3245 | 	case r == '$':
3246 | 		return true
3247 | 	case '0' <= r && r <= '9':
3248 | 		return true
3249 | 	case 'A' <= r && r <= 'Z':
3250 | 		return true
3251 | 	case r == '_':
3252 | 		return true
3253 | 	case 'a' <= r && r <= 'z':
3254 | 		return true
3255 | 	}
3256 | 	return false
3257 | }
3258 | 
3259 | // Copyright 2011 The Go Authors. All rights reserved.
3260 | // Use of this source code is governed by a BSD-style
3261 | // license that can be found in the LICENSE file.
3262 | 
3263 | // Template is a specialized Template from "text/template" that produces a safe
3264 | // HTML document fragment.
3265 | type Template struct {
3266 | 	escaped bool
3267 | 	// We could embed the text/template field, but it's safer not to because
3268 | 	// we need to keep our version of the name space and the underlying
3269 | 	// template's in sync.
3270 | 	text *template.Template
3271 | 	// The underlying template's parse tree, updated to be HTML-safe.
3272 | 	Tree       *parse.Tree
3273 | 	*nameSpace // common to all associated templates
3274 | }
3275 | 
3276 | // nameSpace is the data structure shared by all templates in an association.
3277 | type nameSpace struct {
3278 | 	mu  sync.Mutex
3279 | 	set map[string]*Template
3280 | }
3281 | 
3282 | // Templates returns a slice of the templates associated with t, including t
3283 | // itself.
3284 | func (t *Template) Templates() []*Template {
3285 | 	ns := t.nameSpace
3286 | 	ns.mu.Lock()
3287 | 	defer ns.mu.Unlock()
3288 | 	// Return a slice so we don't expose the map.
3289 | 	m := make([]*Template, 0, len(ns.set))
3290 | 	for _, v := range ns.set {
3291 | 		m = append(m, v)
3292 | 	}
3293 | 	return m
3294 | }
3295 | 
3296 | // escape escapes all associated templates.
3297 | func (t *Template) escape() error {
3298 | 	t.nameSpace.mu.Lock()
3299 | 	defer t.nameSpace.mu.Unlock()
3300 | 	if !t.escaped {
3301 | 		if err := escapeTemplates(t, t.Name()); err != nil {
3302 | 			return err
3303 | 		}
3304 | 		t.escaped = true
3305 | 	}
3306 | 	return nil
3307 | }
3308 | 
3309 | // Execute applies a parsed template to the specified data object,
3310 | // writing the output to wr.
3311 | // If an error occurs executing the template or writing its output,
3312 | // execution stops, but partial results may already have been written to
3313 | // the output writer.
3314 | // A template may be executed safely in parallel.
3315 | func (t *Template) Execute(wr io.Writer, data interface{}) error {
3316 | 	if err := t.escape(); err != nil {
3317 | 		return err
3318 | 	}
3319 | 	return t.text.Execute(wr, data)
3320 | }
3321 | 
3322 | // ExecuteTemplate applies the template associated with t that has the given
3323 | // name to the specified data object and writes the output to wr.
3324 | // If an error occurs executing the template or writing its output,
3325 | // execution stops, but partial results may already have been written to
3326 | // the output writer.
3327 | // A template may be executed safely in parallel.
3328 | func (t *Template) ExecuteTemplate(wr io.Writer, name string, data interface{}) error {
3329 | 	tmpl, err := t.lookupAndEscapeTemplate(name)
3330 | 	if err != nil {
3331 | 		return err
3332 | 	}
3333 | 	return tmpl.text.Execute(wr, data)
3334 | }
3335 | 
3336 | // lookupAndEscapeTemplate guarantees that the template with the given name
3337 | // is escaped, or returns an error if it cannot be. It returns the named
3338 | // template.
3339 | func (t *Template) lookupAndEscapeTemplate(name string) (tmpl *Template, err error) {
3340 | 	t.nameSpace.mu.Lock()
3341 | 	defer t.nameSpace.mu.Unlock()
3342 | 	tmpl = t.set[name]
3343 | 	if tmpl == nil {
3344 | 		return nil, fmt.Errorf("html/template: %q is undefined", name)
3345 | 	}
3346 | 	if tmpl.text.Tree == nil || tmpl.text.Root == nil {
3347 | 		return nil, fmt.Errorf("html/template: %q is an incomplete template", name)
3348 | 	}
3349 | 	if t.text.Lookup(name) == nil {
3350 | 		panic("html/template internal error: template escaping out of sync")
3351 | 	}
3352 | 	if tmpl != nil && !tmpl.escaped {
3353 | 		err = escapeTemplates(tmpl, name)
3354 | 	}
3355 | 	return tmpl, err
3356 | }
3357 | 
3358 | // Parse parses a string into a template. Nested template definitions
3359 | // will be associated with the top-level template t. Parse may be
3360 | // called multiple times to parse definitions of templates to associate
3361 | // with t. It is an error if a resulting template is non-empty (contains
3362 | // content other than template definitions) and would replace a
3363 | // non-empty template with the same name.  (In multiple calls to Parse
3364 | // with the same receiver template, only one call can contain text
3365 | // other than space, comments, and template definitions.)
3366 | func (t *Template) Parse(src string) (*Template, error) {
3367 | 	t.nameSpace.mu.Lock()
3368 | 	t.escaped = false
3369 | 	t.nameSpace.mu.Unlock()
3370 | 	ret, err := t.text.Parse(src)
3371 | 	if err != nil {
3372 | 		return nil, err
3373 | 	}
3374 | 	// In general, all the named templates might have changed underfoot.
3375 | 	// Regardless, some new ones may have been defined.
3376 | 	// The template.Template set has been updated; update ours.
3377 | 	t.nameSpace.mu.Lock()
3378 | 	defer t.nameSpace.mu.Unlock()
3379 | 	for _, v := range ret.Templates() {
3380 | 		name := v.Name()
3381 | 		tmpl := t.set[name]
3382 | 		if tmpl == nil {
3383 | 			tmpl = t.new(name)
3384 | 		}
3385 | 		// Restore our record of this text/template to its unescaped original state.
3386 | 		tmpl.escaped = false
3387 | 		tmpl.text = v
3388 | 		tmpl.Tree = v.Tree
3389 | 	}
3390 | 	return t, nil
3391 | }
3392 | 
3393 | // AddParseTree creates a new template with the name and parse tree
3394 | // and associates it with t.
3395 | //
3396 | // It returns an error if t has already been executed.
3397 | func (t *Template) AddParseTree(name string, tree *parse.Tree) (*Template, error) {
3398 | 	t.nameSpace.mu.Lock()
3399 | 	defer t.nameSpace.mu.Unlock()
3400 | 	if t.escaped {
3401 | 		return nil, fmt.Errorf("html/template: cannot AddParseTree to %q after it has executed", t.Name())
3402 | 	}
3403 | 	text, err := t.text.AddParseTree(name, tree)
3404 | 	if err != nil {
3405 | 		return nil, err
3406 | 	}
3407 | 	ret := &Template{
3408 | 		false,
3409 | 		text,
3410 | 		text.Tree,
3411 | 		t.nameSpace,
3412 | 	}
3413 | 	t.set[name] = ret
3414 | 	return ret, nil
3415 | }
3416 | 
3417 | // Clone returns a duplicate of the template, including all associated
3418 | // templates. The actual representation is not copied, but the name space of
3419 | // associated templates is, so further calls to Parse in the copy will add
3420 | // templates to the copy but not to the original. Clone can be used to prepare
3421 | // common templates and use them with variant definitions for other templates
3422 | // by adding the variants after the clone is made.
3423 | //
3424 | // It returns an error if t has already been executed.
3425 | func (t *Template) Clone() (*Template, error) {
3426 | 	t.nameSpace.mu.Lock()
3427 | 	defer t.nameSpace.mu.Unlock()
3428 | 	if t.escaped {
3429 | 		return nil, fmt.Errorf("html/template: cannot Clone %q after it has executed", t.Name())
3430 | 	}
3431 | 	textClone, err := t.text.Clone()
3432 | 	if err != nil {
3433 | 		return nil, err
3434 | 	}
3435 | 	ret := &Template{
3436 | 		false,
3437 | 		textClone,
3438 | 		textClone.Tree,
3439 | 		&nameSpace{
3440 | 			set: make(map[string]*Template),
3441 | 		},
3442 | 	}
3443 | 	for _, x := range textClone.Templates() {
3444 | 		name := x.Name()
3445 | 		src := t.set[name]
3446 | 		if src == nil || src.escaped {
3447 | 			return nil, fmt.Errorf("html/template: cannot Clone %q after it has executed", t.Name())
3448 | 		}
3449 | 		x.Tree = x.Tree.Copy()
3450 | 		ret.set[name] = &Template{
3451 | 			false,
3452 | 			x,
3453 | 			x.Tree,
3454 | 			ret.nameSpace,
3455 | 		}
3456 | 	}
3457 | 	return ret, nil
3458 | }
3459 | 
3460 | // New allocates a new HTML template with the given name.
3461 | func New(name string) *Template {
3462 | 	tmpl := &Template{
3463 | 		false,
3464 | 		template.New(name),
3465 | 		nil,
3466 | 		&nameSpace{
3467 | 			set: make(map[string]*Template),
3468 | 		},
3469 | 	}
3470 | 	tmpl.set[name] = tmpl
3471 | 	return tmpl
3472 | }
3473 | 
3474 | // New allocates a new HTML template associated with the given one
3475 | // and with the same delimiters. The association, which is transitive,
3476 | // allows one template to invoke another with a {{template}} action.
3477 | func (t *Template) New(name string) *Template {
3478 | 	t.nameSpace.mu.Lock()
3479 | 	defer t.nameSpace.mu.Unlock()
3480 | 	return t.new(name)
3481 | }
3482 | 
3483 | // new is the implementation of New, without the lock.
3484 | func (t *Template) new(name string) *Template {
3485 | 	tmpl := &Template{
3486 | 		false,
3487 | 		t.text.New(name),
3488 | 		nil,
3489 | 		t.nameSpace,
3490 | 	}
3491 | 	tmpl.set[name] = tmpl
3492 | 	return tmpl
3493 | }
3494 | 
3495 | // Name returns the name of the template.
3496 | func (t *Template) Name() string {
3497 | 	return t.text.Name()
3498 | }
3499 | 
3500 | // FuncMap is the type of the map defining the mapping from names to
3501 | // functions. Each function must have either a single return value, or two
3502 | // return values of which the second has type error. In that case, if the
3503 | // second (error) argument evaluates to non-nil during execution, execution
3504 | // terminates and Execute returns that error. FuncMap has the same base type
3505 | // as FuncMap in "text/template", copied here so clients need not import
3506 | // "text/template".
3507 | type FuncMap map[string]interface{}
3508 | 
3509 | // Funcs adds the elements of the argument map to the template's function map.
3510 | // It panics if a value in the map is not a function with appropriate return
3511 | // type. However, it is legal to overwrite elements of the map. The return
3512 | // value is the template, so calls can be chained.
3513 | func (t *Template) Funcs(funcMap FuncMap) *Template {
3514 | 	t.text.Funcs(template.FuncMap(funcMap))
3515 | 	return t
3516 | }
3517 | 
3518 | // Delims sets the action delimiters to the specified strings, to be used in
3519 | // subsequent calls to Parse, ParseFiles, or ParseGlob. Nested template
3520 | // definitions will inherit the settings. An empty delimiter stands for the
3521 | // corresponding default: {{ or }}.
3522 | // The return value is the template, so calls can be chained.
3523 | func (t *Template) Delims(left, right string) *Template {
3524 | 	t.text.Delims(left, right)
3525 | 	return t
3526 | }
3527 | 
3528 | // Lookup returns the template with the given name that is associated with t,
3529 | // or nil if there is no such template.
3530 | func (t *Template) Lookup(name string) *Template {
3531 | 	t.nameSpace.mu.Lock()
3532 | 	defer t.nameSpace.mu.Unlock()
3533 | 	return t.set[name]
3534 | }
3535 | 
3536 | // Must is a helper that wraps a call to a function returning (*Template, error)
3537 | // and panics if the error is non-nil. It is intended for use in variable initializations
3538 | // such as
3539 | //
3540 | //	var t = template.Must(template.New("name").Parse("html"))
3541 | func Must(t *Template, err error) *Template {
3542 | 	if err != nil {
3543 | 		panic(err)
3544 | 	}
3545 | 	return t
3546 | }
3547 | 
3548 | // ParseFiles creates a new Template and parses the template definitions from
3549 | // the named files. The returned template's name will have the (base) name and
3550 | // (parsed) contents of the first file. There must be at least one file.
3551 | // If an error occurs, parsing stops and the returned *Template is nil.
3552 | func ParseFiles(filenames ...string) (*Template, error) {
3553 | 	return parseFiles(nil, filenames...)
3554 | }
3555 | 
3556 | // ParseFiles parses the named files and associates the resulting templates with
3557 | // t. If an error occurs, parsing stops and the returned template is nil;
3558 | // otherwise it is t. There must be at least one file.
3559 | func (t *Template) ParseFiles(filenames ...string) (*Template, error) {
3560 | 	return parseFiles(t, filenames...)
3561 | }
3562 | 
3563 | // parseFiles is the helper for the method and function. If the argument
3564 | // template is nil, it is created from the first file.
3565 | func parseFiles(t *Template, filenames ...string) (*Template, error) {
3566 | 	if len(filenames) == 0 {
3567 | 		// Not really a problem, but be consistent.
3568 | 		return nil, fmt.Errorf("html/template: no files named in call to ParseFiles")
3569 | 	}
3570 | 	for _, filename := range filenames {
3571 | 		b, err := os.ReadFile(filename)
3572 | 		if err != nil {
3573 | 			return nil, err
3574 | 		}
3575 | 		s := string(b)
3576 | 		name := filepath.Base(filename)
3577 | 		// First template becomes return value if not already defined,
3578 | 		// and we use that one for subsequent New calls to associate
3579 | 		// all the templates together. Also, if this file has the same name
3580 | 		// as t, this file becomes the contents of t, so
3581 | 		//  t, err := New(name).Funcs(xxx).ParseFiles(name)
3582 | 		// works. Otherwise we create a new template associated with t.
3583 | 		var tmpl *Template
3584 | 		if t == nil {
3585 | 			t = New(name)
3586 | 		}
3587 | 		if name == t.Name() {
3588 | 			tmpl = t
3589 | 		} else {
3590 | 			tmpl = t.New(name)
3591 | 		}
3592 | 		_, err = tmpl.Parse(s)
3593 | 		if err != nil {
3594 | 			return nil, err
3595 | 		}
3596 | 	}
3597 | 	return t, nil
3598 | }
3599 | 
3600 | // ParseGlob creates a new Template and parses the template definitions from the
3601 | // files identified by the pattern, which must match at least one file. The
3602 | // returned template will have the (base) name and (parsed) contents of the
3603 | // first file matched by the pattern. ParseGlob is equivalent to calling
3604 | // ParseFiles with the list of files matched by the pattern.
3605 | func ParseGlob(pattern string) (*Template, error) {
3606 | 	return parseGlob(nil, pattern)
3607 | }
3608 | 
3609 | // ParseGlob parses the template definitions in the files identified by the
3610 | // pattern and associates the resulting templates with t. The pattern is
3611 | // processed by filepath.Glob and must match at least one file. ParseGlob is
3612 | // equivalent to calling t.ParseFiles with the list of files matched by the
3613 | // pattern.
3614 | func (t *Template) ParseGlob(pattern string) (*Template, error) {
3615 | 	return parseGlob(t, pattern)
3616 | }
3617 | 
3618 | // parseGlob is the implementation of the function and method ParseGlob.
3619 | func parseGlob(t *Template, pattern string) (*Template, error) {
3620 | 	filenames, err := filepath.Glob(pattern)
3621 | 	if err != nil {
3622 | 		return nil, err
3623 | 	}
3624 | 	if len(filenames) == 0 {
3625 | 		return nil, fmt.Errorf("html/template: pattern matches no files: %#q", pattern)
3626 | 	}
3627 | 	return parseFiles(t, filenames...)
3628 | }
3629 | 
3630 | // Copyright 2011 The Go Authors. All rights reserved.
3631 | // Use of this source code is governed by a BSD-style
3632 | // license that can be found in the LICENSE file.
3633 | 
3634 | // urlFilter returns its input unless it contains an unsafe protocol in which
3635 | // case it defangs the entire URL.
3636 | func urlFilter(args ...interface{}) string {
3637 | 	s, t := stringify(args...)
3638 | 	if t == contentTypeURL {
3639 | 		return s
3640 | 	}
3641 | 	if i := strings.IndexRune(s, ':'); i >= 0 && strings.IndexRune(s[:i], '/') < 0 {
3642 | 		protocol := strings.ToLower(s[:i])
3643 | 		if protocol != "http" && protocol != "https" && protocol != "mailto" {
3644 | 			return "#" + filterFailsafe
3645 | 		}
3646 | 	}
3647 | 	return s
3648 | }
3649 | 
3650 | // urlEscaper produces an output that can be embedded in a URL query.
3651 | // The output can be embedded in an HTML attribute without further escaping.
3652 | func urlEscaper(args ...interface{}) string {
3653 | 	return urlProcessor(false, args...)
3654 | }
3655 | 
3656 | // urlEscaper normalizes URL content so it can be embedded in a quote-delimited
3657 | // string or parenthesis delimited url(...).
3658 | // The normalizer does not encode all HTML specials. Specifically, it does not
3659 | // encode '&' so correct embedding in an HTML attribute requires escaping of
3660 | // '&' to '&amp;'.
3661 | func urlNormalizer(args ...interface{}) string {
3662 | 	return urlProcessor(true, args...)
3663 | }
3664 | 
3665 | // urlProcessor normalizes (when norm is true) or escapes its input to produce
3666 | // a valid hierarchical or opaque URL part.
3667 | func urlProcessor(norm bool, args ...interface{}) string {
3668 | 	s, t := stringify(args...)
3669 | 	if t == contentTypeURL {
3670 | 		norm = true
3671 | 	}
3672 | 	var b bytes.Buffer
3673 | 	written := 0
3674 | 	// The byte loop below assumes that all URLs use UTF-8 as the
3675 | 	// content-encoding. This is similar to the URI to IRI encoding scheme
3676 | 	// defined in section 3.1 of  RFC 3987, and behaves the same as the
3677 | 	// EcmaScript builtin encodeURIComponent.
3678 | 	// It should not cause any misencoding of URLs in pages with
3679 | 	// Content-type: text/html;charset=UTF-8.
3680 | 	for i, n := 0, len(s); i < n; i++ {
3681 | 		c := s[i]
3682 | 		switch c {
3683 | 		// Single quote and parens are sub-delims in RFC 3986, but we
3684 | 		// escape them so the output can be embedded in single
3685 | 		// quoted attributes and unquoted CSS url(...) constructs.
3686 | 		// Single quotes are reserved in URLs, but are only used in
3687 | 		// the obsolete "mark" rule in an appendix in RFC 3986
3688 | 		// so can be safely encoded.
3689 | 		case '!', '#', '$', '&', '*', '+', ',', '/', ':', ';', '=', '?', '@', '[', ']':
3690 | 			if norm {
3691 | 				continue
3692 | 			}
3693 | 		// Unreserved according to RFC 3986 sec 2.3
3694 | 		// "For consistency, percent-encoded octets in the ranges of
3695 | 		// ALPHA (%41-%5A and %61-%7A), DIGIT (%30-%39), hyphen (%2D),
3696 | 		// period (%2E), underscore (%5F), or tilde (%7E) should not be
3697 | 		// created by URI producers
3698 | 		case '-', '.', '_', '~':
3699 | 			continue
3700 | 		case '%':
3701 | 			// When normalizing do not re-encode valid escapes.
3702 | 			if norm && i+2 < len(s) && isHex(s[i+1]) && isHex(s[i+2]) {
3703 | 				continue
3704 | 			}
3705 | 		default:
3706 | 			// Unreserved according to RFC 3986 sec 2.3
3707 | 			if 'a' <= c && c <= 'z' {
3708 | 				continue
3709 | 			}
3710 | 			if 'A' <= c && c <= 'Z' {
3711 | 				continue
3712 | 			}
3713 | 			if '0' <= c && c <= '9' {
3714 | 				continue
3715 | 			}
3716 | 		}
3717 | 		b.WriteString(s[written:i])
3718 | 		fmt.Fprintf(&b, "%%%02x", c)
3719 | 		written = i + 1
3720 | 	}
3721 | 	if written == 0 {
3722 | 		return s
3723 | 	}
3724 | 	b.WriteString(s[written:])
3725 | 	return b.String()
3726 | }
3727 | 


--------------------------------------------------------------------------------
/strip_test.go:
--------------------------------------------------------------------------------
 1 | package strip
 2 | 
 3 | import (
 4 | 	"testing"
 5 | )
 6 | 
 7 | func TestStripTags(t *testing.T) {
 8 | 	tests := []struct {
 9 | 		input, want string
10 | 	}{
11 | 		{"", ""},
12 | 		{"Hello, World!", "Hello, World!"},
13 | 		{"foo&amp;bar", "foo&amp;bar"},
14 | 		{`Hello <a href="www.example.com/">World</a>!`, "Hello World!"},
15 | 		{"Foo <textarea>Bar</textarea> Baz", "Foo Bar Baz"},
16 | 		{"Foo <!-- Bar --> Baz", "Foo  Baz"},
17 | 		{"<", "<"},
18 | 		{"foo < bar", "foo < bar"},
19 | 		{`Foo<script type="text/javascript">alert(1337)</script>Bar`, "FooBar"},
20 | 		{`Foo<div title="1>2">Bar`, "FooBar"},
21 | 		{`I <3 Ponies!`, `I <3 Ponies!`},
22 | 		{`<script>foo()</script>`, ``},
23 | 	}
24 | 
25 | 	for _, test := range tests {
26 | 		if got := StripTags(test.input); got != test.want {
27 | 			t.Errorf("%q: want %q, got %q", test.input, test.want, got)
28 | 		}
29 | 	}
30 | }
31 | 


--------------------------------------------------------------------------------