From 582bb304662f2da08f99bf7d05d3fbb634bb531b Mon Sep 17 00:00:00 2001 From: Mike Samuel Date: Wed, 28 Sep 2011 13:32:56 -0700 Subject: [PATCH] exp/template/html: don't normalize '<' in doctypes. The normalization that prevents element name and comment injection in <{{.}} by converting it to <{{.}} breaks Instead of splitting states to have a start of document state and a text state, I whitelist ", } +var doctypeBytes = []byte("b", "a<b", }, + { + "HTML doctype not normalized", + "Hello, World!", + "Hello, World!", + }, + { + "No doctype injection", + `Hello, {{.C}}{{else}}world -->{{.W}}{{end}}",