|
| 1 | +From 5abbff46d6a70d0e31b41ce98cddaa08cc911e3f Mon Sep 17 00:00:00 2001 |
| 2 | +From: Sudipta Pandit <sudpandit@microsoft.com> |
| 3 | +Date: Wed, 5 Feb 2025 20:58:22 +0530 |
| 4 | +Subject: [PATCH] Backport fix for CVE-2023-3978 |
| 5 | + |
| 6 | +Reference: https://go-review.googlesource.com/c/net/+/514896 |
| 7 | +--- |
| 8 | + vendor/golang.org/x/net/html/render.go | 28 ++++++++++++++++++++++---- |
| 9 | + 1 file changed, 24 insertions(+), 4 deletions(-) |
| 10 | + |
| 11 | +diff --git a/vendor/golang.org/x/net/html/render.go b/vendor/golang.org/x/net/html/render.go |
| 12 | +index 497e132..1da09c8 100644 |
| 13 | +--- a/vendor/golang.org/x/net/html/render.go |
| 14 | ++++ b/vendor/golang.org/x/net/html/render.go |
| 15 | +@@ -194,9 +194,8 @@ func render1(w writer, n *Node) error { |
| 16 | + } |
| 17 | + } |
| 18 | + |
| 19 | +- // Render any child nodes. |
| 20 | +- switch n.Data { |
| 21 | +- case "iframe", "noembed", "noframes", "noscript", "plaintext", "script", "style", "xmp": |
| 22 | ++ // Render any child nodes |
| 23 | ++ if childTextNodesAreLiteral(n) { |
| 24 | + for c := n.FirstChild; c != nil; c = c.NextSibling { |
| 25 | + if c.Type == TextNode { |
| 26 | + if _, err := w.WriteString(c.Data); err != nil { |
| 27 | +@@ -213,7 +212,7 @@ func render1(w writer, n *Node) error { |
| 28 | + // last element in the file, with no closing tag. |
| 29 | + return plaintextAbort |
| 30 | + } |
| 31 | +- default: |
| 32 | ++ } else { |
| 33 | + for c := n.FirstChild; c != nil; c = c.NextSibling { |
| 34 | + if err := render1(w, c); err != nil { |
| 35 | + return err |
| 36 | +@@ -231,6 +230,27 @@ func render1(w writer, n *Node) error { |
| 37 | + return w.WriteByte('>') |
| 38 | + } |
| 39 | + |
| 40 | ++func childTextNodesAreLiteral(n *Node) bool { |
| 41 | ++ // Per WHATWG HTML 13.3, if the parent of the current node is a style, |
| 42 | ++ // script, xmp, iframe, noembed, noframes, or plaintext element, and the |
| 43 | ++ // current node is a text node, append the value of the node's data |
| 44 | ++ // literally. The specification is not explicit about it, but we only |
| 45 | ++ // enforce this if we are in the HTML namespace (i.e. when the namespace is |
| 46 | ++ // ""). |
| 47 | ++ // NOTE: we also always include noscript elements, although the |
| 48 | ++ // specification states that they should only be rendered as such if |
| 49 | ++ // scripting is enabled for the node (which is not something we track). |
| 50 | ++ if n.Namespace != "" { |
| 51 | ++ return false |
| 52 | ++ } |
| 53 | ++ switch n.Data { |
| 54 | ++ case "iframe", "noembed", "noframes", "noscript", "plaintext", "script", "style", "xmp": |
| 55 | ++ return true |
| 56 | ++ default: |
| 57 | ++ return false |
| 58 | ++ } |
| 59 | ++} |
| 60 | ++ |
| 61 | + // writeQuoted writes s to w surrounded by quotes. Normally it will use double |
| 62 | + // quotes, but if s contains a double quote, it will use single quotes. |
| 63 | + // It is used for writing the identifiers in a doctype declaration. |
| 64 | +-- |
| 65 | +2.34.1 |
| 66 | + |
0 commit comments