---

// Copyright 2011 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package template import ( "bytes" "encoding/json" "fmt" "os" "strings" "testing" "text/template" "text/template/parse" ) type badMarshaler struct{} func (x *badMarshaler) MarshalJSON() ([]byte, error) { // Keys in valid JSON must be double quoted as must all strings. return []byte("{ foo: 'not quite valid JSON' }"), nil } type goodMarshaler struct{} func (x *goodMarshaler) MarshalJSON() ([]byte, error) { return []byte(`{ "<foo>": "O'Reilly" }`), nil } func TestEscape(t *testing.T) { data := struct { F, T bool C, G, H string A, E []string B, M json.Marshaler N int Z *int W HTML }{ F: false, T: true, C: "<Cincinatti>", G: "<Goodbye>", H: "<Hello>", A: []string{"<a>", "<b>"}, E: []string{}, N: 42, B: &badMarshaler{}, M: &goodMarshaler{}, Z: nil, W: HTML(`¡<b class="foo">Hello</b>, <textarea>O'World!`), } pdata := &data tests := []struct { name string input string output string }{ { "if", "{{if .T}}Hello{{end}}, {{.C}}!", "Hello, <Cincinatti>!", }, { "else", "{{if .F}}{{.H}}{{else}}{{.G}}{{end}}!", "<Goodbye>!", }, { "overescaping1", "Hello, {{.C | html}}!", "Hello, <Cincinatti>!", }, { "overescaping2", "Hello, {{html .C}}!", "Hello, <Cincinatti>!", }, { "overescaping3", "{{with .C}}{{$msg := .}}Hello, {{$msg}}!{{end}}", "Hello, <Cincinatti>!", }, { "assignment", "{{if $x := .H}}{{$x}}{{end}}", "<Hello>", }, { "withBody", "{{with .H}}{{.}}{{end}}", "<Hello>", }, { "withElse", "{{with .E}}{{.}}{{else}}{{.H}}{{end}}", "<Hello>", }, { "rangeBody", "{{range .A}}{{.}}{{end}}", "<a><b>", }, { "rangeElse", "{{range .E}}{{.}}{{else}}{{.H}}{{end}}", "<Hello>", }, { "nonStringValue", "{{.T}}", "true", }, { "constant", ``, ``, }, { "multipleAttrs", "", "", }, { "urlStartRel", ``, ``, }, { "urlStartAbsOk", ``, ``, }, { "protocolRelativeURLStart", ``, ``, }, { "pathRelativeURLStart", ``, ``, }, { "dangerousURLStart", ``, ``, }, { "dangerousURLStart2", ``, ``, }, { "nonHierURL", `"}}>`, ``, }, { "urlPath", ``, ``, }, { "urlQuery", ``, ``, }, { "urlFragment", ``, ``, }, { "urlBranch", ``, ``, }, { "urlBranchConflictMoot", ``, ``, }, { "jsStrValue", "", ``, }, { "jsNumericValue", "", ``, }, { "jsBoolValue", "", ``, }, { "jsNilValue", "", ``, }, { "jsObjValue", "", ``, }, { "jsObjValueScript", "", ``, }, { "jsObjValueNotOverEscaped", "", ``, }, { "jsStr", "", ``, }, { "badMarshaler", ``, ``, }, { "jsMarshaler", ``, ``, }, { "jsStrNotUnderEscaped", "", // URL escaped, then quoted for JS. ``, }, { "jsRe", ``, ``, }, { "jsReBlank", ``, ``, }, { "jsReAmbigOk", ``, // The {if} ends in an ambiguous jsCtx but there is // no slash following so we shouldn't care. ``, }, { "styleBidiKeywordPassed", `

`, `

`, }, { "styleBidiPropNamePassed", `

`, `

`, }, { "styleExpressionBlocked", `

`, `

`, }, { "styleTagSelectorPassed", ``, ``, }, { "styleIDPassed", ``, ``, }, { "styleClassPassed", ``, ``, }, { "styleQuantityPassed", ``, ``, }, { "stylePctPassed", `

`, ``, }, { "styleColorPassed", `

`, `

`, }, { "styleObfuscatedExpressionBlocked", `

`, `

`, }, { "styleMozBindingBlocked", `

`, `

`, }, { "styleObfuscatedMozBindingBlocked", `

`, `

`, }, { "styleFontNameString", `

`, `

`, }, { "styleFontNameString", `

`, `

`, }, { "styleFontNameUnquoted", `

`, `

`, }, { "styleURLQueryEncoded", `

.png"}})">`, `

`, }, { "styleQuotedURLQueryEncoded", `

.png"}}')">`, `

`, }, { "styleStrQueryEncoded", `

.png"}}'">`, `

`, }, { "styleURLBadProtocolBlocked", ``, ``, }, { "styleStrBadProtocolBlocked", ``, ``, }, { "styleStrEncodedProtocolEncoded", ``, // The CSS string 'javascript\\3a alert(1337)' does not contain a colon. ``, }, { "styleURLGoodProtocolPassed", `;{}.html"}}')">`, ``, }, { "styleStrGoodProtocolPassed", `;{}.html"}}'">`, ``, }, { "styleURLEncodedForHTMLInAttr", ``, ``, }, { "styleURLNotEncodedForHTMLInCdata", ``, ``, }, { "styleURLMixedCase", `

`, `

`, }, { "stylePropertyPairPassed", ``, ``, }, { "styleStrSpecialsEncoded", ``, ``, }, { "styleURLSpecialsEncoded", ``, ``, }, { "HTML comment", "Hello, {{.C}}", "Hello, <Cincinatti>", }, { "HTML comment not first < in text node.", "<!--", "<!--", }, { "HTML normalization 1", "a < b", "a < b", }, { "HTML normalization 2", "a << b", "a << b", }, { "HTML normalization 3", "a<b", "a<b", }, { "HTML doctype not normalized", "Hello, World!", "Hello, World!", }, { "HTML doctype not case-insensitive", "Hello, World!", "Hello, World!", }, { "No doctype injection", `Hello, {{.C}}{{else}}world -->{{.W}}{{end}}", "Hello, <Cincinatti>", }, { "JS line comment", "", "", }, { "JS multiline block comment", "", // Newline separates break from call. If newline // removed, then break will consume label leaving // code invalid. "", }, { "JS single-line block comment", "", // Newline separates break from call. If newline // removed, then break will consume label leaving // code invalid. "", }, { "JS block comment flush with mathematical division", "", "", }, { "JS mixed comments", "", "", }, { "CSS comments", "`, "", }, { "JS attr block comment", ``, // Attribute comment tests should pass if the comments // are successfully elided. ``, }, { "JS attr line comment", ``, ``, }, { "CSS attr block comment", ``, ``, }, { "CSS attr line comment", ``, ``, }, { "HTML substitution commented out", "

", "

", }, { "Comment ends flush with start", "", "", }, { "typed HTML in text", `{{.W}}`, `¡Hello, O'World!`, }, { "typed HTML in attribute", `

`, `

`, }, { "typed HTML in script", ``, ``, }, { "typed HTML in RCDATA", `{{.W}}`, `¡<b class="foo">Hello</b>, <textarea>O'World</textarea>!`, }, { "range in textarea", "{{range .A}}{{.}}{{end}}", "<a><b>", }, { "No tag injection", `{{"10$"}}<{{"script src,evil.org/pwnd.js"}}...`, `10$<script src,evil.org/pwnd.js...`, }, { "No comment injection", `<{{"!--"}}`, `<!--`, }, { "No RCDATA end tag injection", `<{{"/textarea "}}...`, `</textarea ...`, }, { "optional attrs", `"}}"{{end}}` + // Double quotes inside if/else. ` src=` + `{{if .T}}"?{{""}}"` + `{{else}}"images/cleardot.gif"{{end}}` + // Missing space before title, but it is not a // part of the src attribute. `{{if .T}}title="{{"