godoc: position URLs (containing file names) must be quoted and URL escaped

Since the posLink_url also adds a non-URL attribute, the quoting and  URL-escaping
must happen inside posLink_url (otherwise the non-URL attribute becomes part or the
URL portion of the tag.

R=r
CC=golang-dev
https://golang.org/cl/4888041

2 files changed, 14 insertions, 14 deletions

diff --git a/lib/godoc/package.html b/lib/godoc/package.html
index 968f69a7c3..265e5d53b5 100644
--- a/lib/godoc/package.html
+++ b/lib/godoc/package.html
@@ -42,7 +42,7 @@
 		{{range .}}
 			{{/* Name is a string - no need for FSet */}}
 			{{$name := html .Name}}
-			<h2 id="{{$name}}">func <a href="/{{posLink .Decl $.FSet}}">{{$name}}</a></h2>
+			<h2 id="{{$name}}">func <a href="/{{posLink_url .Decl $.FSet}}">{{$name}}</a></h2>
 			<p><code>{{node_html .Decl $.FSet}}</code></p>
 			{{comment_html .Doc}}
 		{{end}}
@@ -50,7 +50,7 @@
 	{{with .Types}}
 		{{range .}}
 			{{$tname := node_html .Type.Name $.FSet}}
-			<h2 id="{{$tname}}">type <a href="/{{posLink .Decl $.FSet}}">{{$tname}}</a></h2>
+			<h2 id="{{$tname}}">type <a href="/{{posLink_url .Decl $.FSet}}">{{$tname}}</a></h2>
 			{{comment_html .Doc}}
 			<p><pre>{{node_html .Decl $.FSet}}</pre></p>
 			{{range .Consts}}
@@ -63,13 +63,13 @@
 			{{end}}
 			{{range .Factories}}
 				{{$name := html .Name}}
-				<h3 id="{{$tname}}.{{$name}}">func <a href="/{{posLink .Decl $.FSet}}">{{$name}}</a></h3>
+				<h3 id="{{$tname}}.{{$name}}">func <a href="/{{posLink_url .Decl $.FSet}}">{{$name}}</a></h3>
 				<p><code>{{node_html .Decl $.FSet}}</code></p>
 				{{comment_html .Doc}}
 			{{end}}
 			{{range .Methods}}
 				{{$name := html .Name}}
-				<h3 id="{{$tname}}.{{$name}}">func ({{node_html .Recv $.FSet}}) <a href="/{{posLink .Decl $.FSet}}">{{$name}}</a></h3>
+				<h3 id="{{$tname}}.{{$name}}">func ({{node_html .Recv $.FSet}}) <a href="/{{posLink_url .Decl $.FSet}}">{{$name}}</a></h3>
 				<p><code>{{node_html .Decl $.FSet}}</code></p>
 				{{comment_html .Doc}}
 			{{end}}
diff --git a/src/cmd/godoc/godoc.go b/src/cmd/godoc/godoc.go
index 15b60c72b0..98fdc19d04 100644
--- a/src/cmd/godoc/godoc.go
+++ b/src/cmd/godoc/godoc.go
@@ -465,7 +465,7 @@ func pkgLinkFunc(path string) string {
 	return pkgHandler.pattern[1:] + relpath // remove trailing '/' for relative URL
 }
 
-func posLinkFunc(node ast.Node, fset *token.FileSet) string {
+func posLink_urlFunc(node ast.Node, fset *token.FileSet) string {
 	var relpath string
 	var line int
 	var low, high int // selection
@@ -481,10 +481,10 @@ func posLinkFunc(node ast.Node, fset *token.FileSet) string {
 	}
 
 	var buf bytes.Buffer
-	buf.WriteString(relpath)
+	buf.WriteString(http.URLEscape(relpath))
 	// selection ranges are of form "s=low:high"
 	if low < high {
-		fmt.Fprintf(&buf, "?s=%d:%d", low, high)
+		fmt.Fprintf(&buf, "?s=%d:%d", low, high) // no need for URL escaping
 		// if we have a selection, position the page
 		// such that the selection is a bit below the top
 		line -= 10
@@ -495,16 +495,16 @@ func posLinkFunc(node ast.Node, fset *token.FileSet) string {
 	// line id's in html-printed source are of the
 	// form "L%d" where %d stands for the line number
 	if line > 0 {
-		fmt.Fprintf(&buf, "#L%d", line)
+		fmt.Fprintf(&buf, "#L%d", line) // no need for URL escaping
 	}
 
 	return buf.String()
 }
 
 // fmap describes the template functions installed with all godoc templates.
-// Convention: template function names ending in "_html" produce an HTML-
-//             escaped string; all other function results may require HTML
-//             or URL escaping in the template.
+// Convention: template function names ending in "_html" or "_url" produce
+//             HTML- or URL-escaped strings; all other function results may
+//             require explicit escaping in the template.
 var fmap = template.FuncMap{
 	// various helpers
 	"filename": filenameFunc,
@@ -525,9 +525,9 @@ var fmap = template.FuncMap{
 	"comment_html": comment_htmlFunc,
 
 	// support for URL attributes
-	"pkgLink": pkgLinkFunc,
-	"srcLink": relativeURL,
-	"posLink": posLinkFunc,
+	"pkgLink":     pkgLinkFunc,
+	"srcLink":     relativeURL,
+	"posLink_url": posLink_urlFunc,
 }
 
 func readTemplate(name string) *template.Template {