Skip to content

Commit 2e65ef6

Browse files
tmthrgddmitshur
tmthrgd
authored and
dmitshur
committed
[release-branch.go1.13] encoding/json: revert Compact HTML escaping documentation
This partly reverts CL 173417 as it incorrectly documented that Compact performed HTML escaping and the output was safe to embed inside HTML <script> tags. This has never been true. Although Compact does escape U+2028 and U+2029, it doesn't escape <, > or &. Compact is thus only performing a subset of HTML escaping and it's output is not safe to embed inside HTML <script> tags. A more complete fix would be for Compact to either never perform any HTML escaping, as it was prior to CL 10883045, or to actually perform the same HTML escaping as HTMLEscape. Neither change is likely safe enough for go1.13. Fixes golang#34006 Updates golang#30357 Change-Id: I912f0fe9611097d988048b28228c4a5b985080ba GitHub-Last-Rev: aebabab GitHub-Pull-Request: golang#33427 Reviewed-on: https://go-review.googlesource.com/c/go/+/188717 Reviewed-by: Daniel Martí <[email protected]> Run-TryBot: Daniel Martí <[email protected]> TryBot-Result: Gobot Gobot <[email protected]> (cherry picked from commit 79669dc) Reviewed-on: https://go-review.googlesource.com/c/go/+/192747 Reviewed-by: Andrew Bonventre <[email protected]> Run-TryBot: Andrew Bonventre <[email protected]>
1 parent d7b402a commit 2e65ef6

1 file changed

Lines changed: 0 additions & 3 deletions

File tree

‎src/encoding/json/indent.go‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,6 @@ import "bytes"
88

99
// Compact appends to dst the JSON-encoded src with
1010
// insignificant space characters elided.
11-
// Like Marshal, Compact applies HTMLEscape to any
12-
// string literals so that the JSON will be safe to embed
13-
// inside HTML <script> tags.
1411
func Compact(dst *bytes.Buffer, src []byte) error {
1512
return compact(dst, src, false)
1613
}

0 commit comments

Comments
 (0)