html: escape comment and doctype tokens' data

nigeltao · nigeltao · commit 06994584191e · 2022-07-26T23:03:23.000Z
Fixes golang/go#48237 Change-Id: I309e3ad30684fb71b9b3e67dfac156da08dbc69b Reviewed-on: https://go-review.googlesource.com/c/net/+/419334 Run-TryBot: Nigel Tao <nigeltao@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Kunpei Sakai <namusyaka@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org>
diff --git a/html/render.go b/html/render.go
@@ -85,7 +85,7 @@ func render1(w writer, n *Node) error {
 		if _, err := w.WriteString("<!--"); err != nil {
 			return err
 		}
-		if _, err := w.WriteString(n.Data); err != nil {
+		if err := escape(w, n.Data); err != nil {
 			return err
 		}
 		if _, err := w.WriteString("-->"); err != nil {
@@ -96,7 +96,7 @@ func render1(w writer, n *Node) error {
 		if _, err := w.WriteString("<!DOCTYPE "); err != nil {
 			return err
 		}
-		if _, err := w.WriteString(n.Data); err != nil {
+		if err := escape(w, n.Data); err != nil {
 			return err
 		}
 		if n.Attr != nil {
diff --git a/html/render_test.go b/html/render_test.go
@@ -94,6 +94,10 @@ func TestRenderer(t *testing.T) {
 			Data: "comm",
 		},
 		15: {
+			Type: CommentNode,
+			Data: "x-->y", // Needs escaping.
+		},
+		16: {
 			Type: RawNode,
 			Data: "7<pre>8</pre>9",
 		},
@@ -119,7 +123,8 @@ func TestRenderer(t *testing.T) {
 		12: `.	.	<br>`,
 		13: `.	.	"6"`,
 		14: `.	.	"<!--comm-->"`,
-		15: `.	.	"7<pre>8</pre>9"`,
+		15: `.	.	"<!--x--&gt;y-->"`,
+		16: `.	.	"7<pre>8</pre>9"`,
 	}
 	if len(nodes) != len(treeAsText) {
 		t.Fatal("len(nodes) != len(treeAsText)")
@@ -155,7 +160,7 @@ func TestRenderer(t *testing.T) {
 
 	want := `<html><head></head><body>0&lt;1<p id="A" foo="abc&#34;def">` +
 		`2<b empty="">3</b><i backslash="\">&amp;4</i></p>` +
-		`5<blockquote></blockquote><br/>6<!--comm-->7<pre>8</pre>9</body></html>`
+		`5<blockquote></blockquote><br/>6<!--comm--><!--x--&gt;y-->7<pre>8</pre>9</body></html>`
 	b := new(bytes.Buffer)
 	if err := Render(b, nodes[0]); err != nil {
 		t.Fatal(err)
diff --git a/html/token.go b/html/token.go
@@ -110,9 +110,9 @@ func (t Token) String() string {
 	case SelfClosingTagToken:
 		return "<" + t.tagString() + "/>"
 	case CommentToken:
-		return "<!--" + t.Data + "-->"
+		return "<!--" + EscapeString(t.Data) + "-->"
 	case DoctypeToken:
-		return "<!DOCTYPE " + t.Data + ">"
+		return "<!DOCTYPE " + EscapeString(t.Data) + ">"
 	}
 	return "Invalid(" + strconv.Itoa(int(t.Type)) + ")"
 }
diff --git a/html/token_test.go b/html/token_test.go
@@ -314,12 +314,12 @@ var tokenTests = []tokenTest{
 	{
 		"comment3",
 		"a<!--x>-->z",
-		"a$<!--x>-->$z",
+		"a$<!--x&gt;-->$z",
 	},
 	{
 		"comment4",
 		"a<!--x->-->z",
-		"a$<!--x->-->$z",
+		"a$<!--x-&gt;-->$z",
 	},
 	{
 		"comment5",
@@ -334,7 +334,7 @@ var tokenTests = []tokenTest{
 	{
 		"comment7",
 		"a<!---<>z",
-		"a$<!---<>z-->",
+		"a$<!---&lt;&gt;z-->",
 	},
 	{
 		"comment8",

Original file line number	Diff line number	Diff line change
`@@ -85,7 +85,7 @@ func render1(w writer, n *Node) error {`
`85`	`85`	`if _, err := w.WriteString("<!--"); err != nil {`
`86`	`86`	`return err`
`87`	`87`	`}`
`88`		`- if _, err := w.WriteString(n.Data); err != nil {`
	`88`	`+ if err := escape(w, n.Data); err != nil {`
`89`	`89`	`return err`
`90`	`90`	`}`
`91`	`91`	`if _, err := w.WriteString("-->"); err != nil {`
`@@ -96,7 +96,7 @@ func render1(w writer, n *Node) error {`
`96`	`96`	`if _, err := w.WriteString("<!DOCTYPE "); err != nil {`
`97`	`97`	`return err`
`98`	`98`	`}`
`99`		`- if _, err := w.WriteString(n.Data); err != nil {`
	`99`	`+ if err := escape(w, n.Data); err != nil {`
`100`	`100`	`return err`
`101`	`101`	`}`
`102`	`102`	`if n.Attr != nil {`
Original file line number	Diff line number	Diff line change
`@@ -110,9 +110,9 @@ func (t Token) String() string {`
`110`	`110`	`case SelfClosingTagToken:`
`111`	`111`	`return "<" + t.tagString() + "/>"`
`112`	`112`	`case CommentToken:`
`113`		`- return "<!--" + t.Data + "-->"`
	`113`	`+ return "<!--" + EscapeString(t.Data) + "-->"`
`114`	`114`	`case DoctypeToken:`
`115`		`- return "<!DOCTYPE " + t.Data + ">"`
	`115`	`+ return "<!DOCTYPE " + EscapeString(t.Data) + ">"`
`116`	`116`	`}`
`117`	`117`	`return "Invalid(" + strconv.Itoa(int(t.Type)) + ")"`
`118`	`118`	`}`
Original file line number	Diff line number	Diff line change
`@@ -314,12 +314,12 @@ var tokenTests = []tokenTest{`
`314`	`314`	`{`
`315`	`315`	`"comment3",`
`316`	`316`	`"a<!--x>-->z",`
`317`		`- "a$<!--x>-->$z",`
	`317`	`+ "a$<!--x>-->$z",`
`318`	`318`	`},`
`319`	`319`	`{`
`320`	`320`	`"comment4",`
`321`	`321`	`"a<!--x->-->z",`
`322`		`- "a$<!--x->-->$z",`
	`322`	`+ "a$<!--x->-->$z",`
`323`	`323`	`},`
`324`	`324`	`{`
`325`	`325`	`"comment5",`
`@@ -334,7 +334,7 @@ var tokenTests = []tokenTest{`
`334`	`334`	`{`
`335`	`335`	`"comment7",`
`336`	`336`	`"a<!---<>z",`
`337`		`- "a$<!---<>z-->",`
	`337`	`+ "a$<!---<>z-->",`
`338`	`338`	`},`
`339`	`339`	`{`
`340`	`340`	`"comment8",`