• Didier Spezia's avatar
    html/template: fix pipeline sanitization · 91d989eb
    Didier Spezia authored
    Pipelines are altered by inserting sanitizers if they are not
    already present. The code makes the assumption that the first
    operands of each commands are function identifiers.
    
    This is wrong, since they can also be methods. It results in
    a panic with templates such as {{1|print 2|.f 3}}
    
    Adds an extra type assertion to make sure only identifiers
    are compared with sanitizers.
    
    Fixes #10673
    
    Change-Id: I3eb820982675231dbfa970f197abc5ef335ce86b
    Reviewed-on: https://go-review.googlesource.com/9801Reviewed-by: default avatarRob Pike <r@golang.org>
    91d989eb
escape_test.go 42.2 KB