diff options
| -rw-r--r-- | src/html/template/css.go | 2 | ||||
| -rw-r--r-- | src/html/template/css_test.go | 2 |
2 files changed, 3 insertions, 1 deletions
diff --git a/src/html/template/css.go b/src/html/template/css.go index 890a0c6b22..f650d8b3e8 100644 --- a/src/html/template/css.go +++ b/src/html/template/css.go @@ -238,7 +238,7 @@ func cssValueFilter(args ...any) string { // inside a string that might embed JavaScript source. for i, c := range b { switch c { - case 0, '"', '\'', '(', ')', '/', ';', '@', '[', '\\', ']', '`', '{', '}': + case 0, '"', '\'', '(', ')', '/', ';', '@', '[', '\\', ']', '`', '{', '}', '<', '>': return filterFailsafe case '-': // Disallow <!-- or -->. diff --git a/src/html/template/css_test.go b/src/html/template/css_test.go index a735638b03..2b76256a76 100644 --- a/src/html/template/css_test.go +++ b/src/html/template/css_test.go @@ -231,6 +231,8 @@ func TestCSSValueFilter(t *testing.T) { {`-exp\000052 ession(alert(1337))`, "ZgotmplZ"}, {`-expre\0000073sion`, "-expre\x073sion"}, {`@import url evil.css`, "ZgotmplZ"}, + {"<", "ZgotmplZ"}, + {">", "ZgotmplZ"}, } for _, test := range tests { got := cssValueFilter(test.css) |