1 // Copyright 2011 The Go Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style
3 // license that can be found in the LICENSE file.
14 // htmlNospaceEscaper escapes for inclusion in unquoted attribute values.
15 func htmlNospaceEscaper(args ...interface{}) string {
16 s, t := stringify(args...)
17 if t == contentTypeHTML {
18 return htmlReplacer(stripTags(s), htmlNospaceNormReplacementTable, false)
20 return htmlReplacer(s, htmlNospaceReplacementTable, false)
23 // attrEscaper escapes for inclusion in quoted attribute values.
24 func attrEscaper(args ...interface{}) string {
25 s, t := stringify(args...)
26 if t == contentTypeHTML {
27 return htmlReplacer(stripTags(s), htmlNormReplacementTable, true)
29 return htmlReplacer(s, htmlReplacementTable, true)
32 // rcdataEscaper escapes for inclusion in an RCDATA element body.
33 func rcdataEscaper(args ...interface{}) string {
34 s, t := stringify(args...)
35 if t == contentTypeHTML {
36 return htmlReplacer(s, htmlNormReplacementTable, true)
38 return htmlReplacer(s, htmlReplacementTable, true)
41 // htmlEscaper escapes for inclusion in HTML text.
42 func htmlEscaper(args ...interface{}) string {
43 s, t := stringify(args...)
44 if t == contentTypeHTML {
47 return htmlReplacer(s, htmlReplacementTable, true)
50 // htmlReplacementTable contains the runes that need to be escaped
51 // inside a quoted attribute value or in a text node.
52 var htmlReplacementTable = []string{
53 // http://www.w3.org/TR/html5/tokenization.html#attribute-value-unquoted-state: "
54 // U+0000 NULL Parse error. Append a U+FFFD REPLACEMENT
55 // CHARACTER character to the current attribute's value.
58 // http://www.w3.org/TR/html5/tokenization.html#before-attribute-value-state
68 // htmlNormReplacementTable is like htmlReplacementTable but without '&' to
69 // avoid over-encoding existing entities.
70 var htmlNormReplacementTable = []string{
79 // htmlNospaceReplacementTable contains the runes that need to be escaped
80 // inside an unquoted attribute value.
81 // The set of runes escaped is the union of the HTML specials and
82 // those determined by running the JS below in browsers:
84 // <script>(function () {
85 // var a = [], d = document.getElementById("d"), i, c, s;
86 // for (i = 0; i < 0x10000; ++i) {
87 // c = String.fromCharCode(i);
88 // d.innerHTML = "<span title=" + c + "lt" + c + "></span>"
89 // s = d.getElementsByTagName("SPAN")[0];
90 // if (!s || s.title !== c + "lt" + c) { a.push(i.toString(16)); }
92 // document.write(a.join(", "));
94 var htmlNospaceReplacementTable = []string{
109 // A parse error in the attribute value (unquoted) and
110 // before attribute value states.
111 // Treated as a quoting character by IE.
115 // htmlNospaceNormReplacementTable is like htmlNospaceReplacementTable but
116 // without '&' to avoid over-encoding existing entities.
117 var htmlNospaceNormReplacementTable = []string{
131 // A parse error in the attribute value (unquoted) and
132 // before attribute value states.
133 // Treated as a quoting character by IE.
137 // htmlReplacer returns s with runes replaced according to replacementTable
138 // and when badRunes is true, certain bad runes are allowed through unescaped.
139 func htmlReplacer(s string, replacementTable []string, badRunes bool) string {
140 written, b := 0, new(bytes.Buffer)
141 for i, r := range s {
142 if int(r) < len(replacementTable) {
143 if repl := replacementTable[r]; len(repl) != 0 {
144 b.WriteString(s[written:i])
146 // Valid as long as replacementTable doesn't
147 // include anything above 0x7f.
148 written = i + utf8.RuneLen(r)
152 // IE does not allow these ranges in unquoted attrs.
153 } else if 0xfdd0 <= r && r <= 0xfdef || 0xfff0 <= r && r <= 0xffff {
154 fmt.Fprintf(b, "%s&#x%x;", s[written:i], r)
155 written = i + utf8.RuneLen(r)
161 b.WriteString(s[written:])
165 // stripTags takes a snippet of HTML and returns only the text content.
166 // For example, `<b>¡Hi!</b> <script>...</script>` -> `¡Hi! `.
167 func stripTags(html string) string {
169 s, c, i, allText := []byte(html), context{}, 0, true
170 // Using the transition funcs helps us avoid mangling
171 // `<div title="1>2">` or `I <3 Ponies!`.
173 if c.delim == delimNone {
175 // Use RCDATA instead of parsing into JS or CSS styles.
176 if c.element != elementNone && !isInTag(st) {
179 d, nread := transitionFunc[st](c, s[i:])
181 if c.state == stateText || c.state == stateRCDATA {
182 // Emit text up to the start of the tag or comment.
184 if d.state != c.state {
185 for j1 := j - 1; j1 >= i; j1-- {
199 i1 := i + bytes.IndexAny(s[i:], delimEnds[c.delim])
203 if c.delim != delimSpaceOrTagEnd {
204 // Consume any quote.
207 c, i = context{state: stateTag, element: c.element}, i1
211 } else if c.state == stateText || c.state == stateRCDATA {
217 // htmlNameFilter accepts valid parts of an HTML attribute or tag name or
218 // a known-safe HTML attribute.
219 func htmlNameFilter(args ...interface{}) string {
220 s, t := stringify(args...)
221 if t == contentTypeHTMLAttr {
225 // Avoid violation of structure preservation.
226 // <input checked {{.K}}={{.V}}>.
227 // Without this, if .K is empty then .V is the value of
228 // checked, but otherwise .V is the value of the attribute
230 return filterFailsafe
232 s = strings.ToLower(s)
233 if t := attrType(s); t != contentTypePlain {
234 // TODO: Split attr and element name part filters so we can whitelist
236 return filterFailsafe
238 for _, r := range s {
240 case '0' <= r && r <= '9':
241 case 'a' <= r && r <= 'z':
243 return filterFailsafe
249 // commentEscaper returns the empty string regardless of input.
250 // Comment content does not correspond to any parsed structure or
251 // human-readable content, so the simplest and most secure policy is to drop
252 // content interpolated into comments.
253 // This approach is equally valid whether or not static comment content is
254 // removed from the template.
255 func commentEscaper(args ...interface{}) string {