diff options
| author | Michael Anthony Knyszek <mknyszek@google.com> | 2023-04-04 22:07:09 +0000 |
|---|---|---|
| committer | Gopher Robot <gobot@golang.org> | 2023-04-05 15:42:48 +0000 |
| commit | 0d719823af1343f9921ee0293596f09e36ced0e4 (patch) | |
| tree | 4448d2aab27bdcff53d2d3e9210fb658f63ab9d9 /src/html | |
| parent | 3e8f5457ef79c2574ba34f8dafc5ad95464c172d (diff) | |
| download | go-0d719823af1343f9921ee0293596f09e36ced0e4.tar.gz go-0d719823af1343f9921ee0293596f09e36ced0e4.zip | |
html/template,mime/multipart: document new GODEBUG settings
This change documents the new GODEBUG settings introduced for
html/template and mime/multipart, released with Go 1.19.8 and Go 1.20.3
as part of a security fix.
Updates #59153.
Updates #59234.
Change-Id: I25f4d8245da3301dccccfb44da8ff1a5985392a4
Reviewed-on: https://go-review.googlesource.com/c/go/+/482238
Auto-Submit: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Diffstat (limited to 'src/html')
| -rw-r--r-- | src/html/template/doc.go | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/html/template/doc.go b/src/html/template/doc.go index 57990e8a38..672d42ba32 100644 --- a/src/html/template/doc.go +++ b/src/html/template/doc.go @@ -231,5 +231,12 @@ Least Surprise Property: "A developer (or code reviewer) familiar with HTML, CSS, and JavaScript, who knows that contextual autoescaping happens should be able to look at a {{.}} and correctly infer what sanitization happens." + +As a consequence of the Least Surprise Property, template actions within an +ECMAScript 6 template literal are disabled by default. +Handling string interpolation within these literals is rather complex resulting +in no clear safe way to support it. +To re-enable template actions within ECMAScript 6 template literals, use the +GODEBUG=jstmpllitinterp=1 environment variable. */ package template |