delta/go-git.git/src/html/template, branch dev.link

encoding/json: add "json: " prefix to SyntaxError messages

2020-10-21T18:50:01+00:00

The other named errors - UnmarshalTypeError, etc - in this package do
the same, so we should prepend the package prefix to error messages
for consistency.

Add a note to the release docs in case this is interpreted as
a breaking change.

Fixes #36221.

Change-Id: Ie24b532bbf9812e108c259fa377e2a6b64319ed4
Reviewed-on: https://go-review.googlesource.com/c/go/+/263619
Run-TryBot: Kevin Burke 
TryBot-Result: Go Bot 
Trust: Kevin Burke 
Trust: Daniel Martí 
Reviewed-by: Daniel Martí

all: update references to symbols moved from io/ioutil to io

2020-10-20T18:41:18+00:00

The old ioutil references are still valid, but update our code
to reflect best practices and get used to the new locations.

Code compiled with the bootstrap toolchain
(cmd/asm, cmd/dist, cmd/compile, debug/elf)
must remain Go 1.4-compatible and is excluded.
Also excluded vendored code.

For #41190.

Change-Id: I6d86f2bf7bc37a9d904b6cee3fe0c7af6d94d5b1
Reviewed-on: https://go-review.googlesource.com/c/go/+/263142
Trust: Russ Cox 
Run-TryBot: Russ Cox 
TryBot-Result: Go Bot 
Reviewed-by: Emmanuel Odeke

html/template, text/template: add ParseFS

2020-10-20T18:41:14+00:00

Now templates can be parsed not just from operating system files
but from arbitrary file systems, including zip files.

For #41190.

Change-Id: I2172001388ddb1f13defa6c5e644e8ec8703ee80
Reviewed-on: https://go-review.googlesource.com/c/go/+/243938
Trust: Russ Cox 
Run-TryBot: Russ Cox 
TryBot-Result: Go Bot 
Reviewed-by: Rob Pike

text/template: allow newlines inside action delimiters

2020-10-12T16:30:36+00:00

This allows multiline constructs like:

	{{"hello" |
	  printf}}

Now that unclosed actions can span multiple lines,
track and report the start of the action when reporting errors.

Also clean up a few "unexpected " to be just "".

Fixes #29770.

Change-Id: I54c6c016029a8328b7902a4b6d85eab713ec3285
Reviewed-on: https://go-review.googlesource.com/c/go/+/254257
Trust: Russ Cox 
Run-TryBot: Russ Cox 
TryBot-Result: Go Bot 
Reviewed-by: Rob Pike

text/template: add CommentNode to template parse tree

2020-08-28T21:45:12+00:00

Fixes #34652

Change-Id: Icf6e3eda593fed826736f34f95a9d66f5450cc98
Reviewed-on: https://go-review.googlesource.com/c/go/+/229398
Reviewed-by: Daniel Martí 
Run-TryBot: Daniel Martí 
TryBot-Result: Gobot Gobot

html/template: add tests from text/template

2020-07-14T16:54:25+00:00

Copy and adapt tests from text/template, to exercise more of html/template's copy.

Various differences in behavior are flagged with NOTE comments or t.Skip
and documented in #40075. Many of them are probably bugs.
One clarifying test case added to both text/template and html/template.

No changes to the package itself.

Change-Id: Ifefad83d647db846040d24c2741a0244b00ade82
Reviewed-on: https://go-review.googlesource.com/c/go/+/241084
Run-TryBot: Russ Cox 
TryBot-Result: Gobot Gobot 
Reviewed-by: Rob Pike

all: avoid awkward wording from CL 236857

2020-06-08T21:36:04+00:00

CL 236857 removed all uses of whitelist/blacklist, which is great.
But it substituted awkward phrasing using allowlist/blocklist,
especially as verbs or participles. This CL uses more standard English,
like "allow the function" or "blocked functions" instead of
"allowlist the function" or "blocklisted functions".

Change-Id: I9106a2fdbd62751c4cbda3a77181358a8a6d0f13
Reviewed-on: https://go-review.googlesource.com/c/go/+/236917
Run-TryBot: Russ Cox 
Reviewed-by: Ian Lance Taylor

all: replace usages of whitelist/blacklist and master/slave

2020-06-08T01:03:14+00:00

There's been plenty of discussion on the usage of these terms in tech.
I'm not trying to have yet another debate. It's clear that there are
people who are hurt by them and who are made to feel unwelcome by their
use due not to technical reasons but to their historical and social
context. That's simply enough reason to replace them.

Anyway, allowlist and blocklist are more self-explanatory than whitelist
and blacklist, so this change has negative cost.

Didn't change vendored, bundled, and minified files. Nearly all changes
are tests or comments, with a couple renames in cmd/link and cmd/oldlink
which are extremely safe. This should be fine to land during the freeze
without even asking for an exception.

Change-Id: I8fc54a3c8f9cc1973b710bbb9558a9e45810b896
Reviewed-on: https://go-review.googlesource.com/c/go/+/236857
Reviewed-by: Brad Fitzpatrick 
Reviewed-by: Khosrow Moossavi 
Reviewed-by: Leigh McCulloch 
Reviewed-by: Urban Ishimwe

html/template,text/template: switch to Unicode escapes for JSON compatibility

2020-04-16T17:13:33+00:00

The existing implementation is not compatible with JSON
escape as it uses hex escaping.
Unicode escape, instead, is valid for both JSON and JS.
This fix avoids creating a separate escaping context for
scripts of type "application/ld+json" and it is more
future-proof in case more JSON+JS contexts get added
to the platform (e.g. import maps).

Fixes #33671
Fixes #37634

Change-Id: Id6f6524b4abc52e81d9d744d46bbe5bf2e081543
Reviewed-on: https://go-review.googlesource.com/c/go/+/226097
Reviewed-by: Carl Johnson 
Reviewed-by: Daniel Martí 
Run-TryBot: Daniel Martí 
TryBot-Result: Gobot Gobot

text/template: harden JSEscape to also escape ampersand and equal

2019-11-21T22:20:17+00:00

Ampersand and equal are not dangerous in a JS/JSString context
but they might cause issues if interpolated in HTML attributes.

This change makes it harder to introduce XSS by misusing
escaping.

Thanks to t1ddl3r  for reporting this common
misuse scenario.

Fixes #35665

Change-Id: Ice6416477bba4cb2ba2fe2cfdc20e027957255c0
Reviewed-on: https://go-review.googlesource.com/c/go/+/207637
Reviewed-by: Filippo Valsorda 
Reviewed-by: Mike Samuel 
Reviewed-by: Andrew Bonventre 
Reviewed-by: Daniel Martí