Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
Use html/template for escaping by default
Allow HTML only with a few specific functions
Matthew Holt committed
Jun 27, 2019 at 13:30 UTC
006dc1792f0118552f81e17cfbe2802a3180c352
2 files changed
+17
-11
modules/caddyhttp/templates/tplcontext.go
+16
-10
@@ -3,13 +3,13 @@ package templates
3
import (
4
"bytes"
5
"fmt"
6
+ "html/template"
7
"io"
8
"net"
9
"net/http"
10
"path"
11
"strings"
12
"sync"
12
- "text/template"
13
14
"github.com/Masterminds/sprig"
15
"github.com/caddyserver/caddy/modules/caddyhttp"
@@ -27,7 +27,10 @@ type templateContext struct {
27
}
28
29
// Include returns the contents of filename relative to the site root.
30
-func (c templateContext) Include(filename string, args ...interface{}) (string, error) {
30
+// Note that included files are NOT escaped, so you should only include
31
+// trusted files. If it is not trusted, be sure to use escaping functions
32
+// in your template.
33
+func (c templateContext) Include(filename string, args ...interface{}) (template.HTML, error) {
34
if c.Root == nil {
35
return "", fmt.Errorf("root file system not specified")
36
}
@@ -54,12 +57,14 @@ func (c templateContext) Include(filename string, args ...interface{}) (string,
57
return "", err
58
}
59
57
- return bodyBuf.String(), nil
60
+ return template.HTML(bodyBuf.String()), nil
61
}
62
63
// HTTPInclude returns the body of a virtual (lightweight) request
61
-// to the given URI on the same server.
62
-func (c templateContext) HTTPInclude(uri string) (string, error) {
64
+// to the given URI on the same server. Note that included bodies
65
+// are NOT escaped, so you should only include trusted resources.
66
+// If it is not trusted, be sure to use escaping functions yourself.
67
+func (c templateContext) HTTPInclude(uri string) (template.HTML, error) {
68
if c.Req.Header.Get(recursionPreventionHeader) == "1" {
69
return "", fmt.Errorf("virtual include cycle")
70
}
@@ -87,11 +92,11 @@ func (c templateContext) HTTPInclude(uri string) (string, error) {
92
return "", err
93
}
94
90
- return buf.String(), nil
95
+ return template.HTML(buf.String()), nil
96
}
97
98
func (c templateContext) executeTemplateInBuffer(tplName string, buf *bytes.Buffer) error {
94
- tpl := template.New(tplName).Funcs(sprig.TxtFuncMap())
99
+ tpl := template.New(tplName).Funcs(sprig.FuncMap())
100
if len(c.config.Delimiters) == 2 {
101
tpl.Delims(c.config.Delimiters[0], c.config.Delimiters[1])
102
}
@@ -186,9 +191,10 @@ func (c templateContext) StripHTML(s string) string {
191
return buf.String()
192
}
193
189
-// Markdown renders the markdown body as HTML.
190
-func (c templateContext) Markdown(body string) string {
191
- return string(blackfriday.Run([]byte(body)))
194
+// Markdown renders the markdown body as HTML. The resulting
195
+// HTML is NOT escaped so that it can be rendered as HTML.
196
+func (c templateContext) Markdown(body string) template.HTML {
197
+ return template.HTML(blackfriday.Run([]byte(body)))
198
}
199
200
// ListFiles reads and returns a slice of names from the given
modules/caddyhttp/templates/tplcontext_test.go
+1
-1
@@ -40,7 +40,7 @@ func TestMarkdown(t *testing.T) {
40
expect: "<ul>\n<li>str1</li>\n<li>str2</li>\n</ul>\n",
41
},
42
} {
43
- result := context.Markdown(test.body)
43
+ result := string(context.Markdown(test.body))
44
if result != test.expect {
45
t.Errorf("Test %d: expected '%s' but got '%s'", i, test.expect, result)
46
}