[go] html/template: fix escaper bypass by treating empty script type as JavaScript

1 view
Skip to first unread message

Neal Patel (Gerrit)

unread,
Apr 27, 2026, 5:37:22 PM (2 days ago) Apr 27
to goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com

Neal Patel has uploaded the change for review

Commit message

html/template: fix escaper bypass by treating empty script type as JavaScript

Thank you to Mundur (https://github.com/M0nd0R) for reporting this issue.

Fixes #78981
Fixes CVE-2026-39826
Change-Id: I3f2e06496020ece655d156fb099ff556af8cc836

Change diff

diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go
index a39d696..aef5e01 100644
--- a/src/html/template/escape_test.go
+++ b/src/html/template/escape_test.go
@@ -233,6 +233,21 @@
 			`<script>alert(["\u003ca\u003e","\u003cb\u003e"])</script>`,
 		},
 		{
+			"scriptTypeSpace",
+			"<script type=\" \">{{.H}}</script>",
+			"<script type=\" \">\"\\u003cHello\\u003e\"</script>",
+		},
+		{
+			"scriptTypeTab",
+			"<script type=\"\t\">{{.H}}</script>",
+			"<script type=\"\t\">\"\\u003cHello\\u003e\"</script>",
+		},
+		{
+			"scriptTypeEmpty",
+			"<script type=\"\">{{.H}}</script>",
+			"<script type=\"\">\"\\u003cHello\\u003e\"</script>",
+		},
+		{
 			"jsObjValueNotOverEscaped",
 			"<button onclick='alert({{.A | html}})'>",
 			`<button onclick='alert([&#34;\u003ca\u003e&#34;,&#34;\u003cb\u003e&#34;])'>`,
diff --git a/src/html/template/js.go b/src/html/template/js.go
index b3bf948..e2db30f 100644
--- a/src/html/template/js.go
+++ b/src/html/template/js.go
@@ -462,6 +462,7 @@
 	mimeType = strings.TrimSpace(mimeType)
 	switch mimeType {
 	case
+		"",
 		"application/ecmascript",
 		"application/javascript",
 		"application/json",

Change information

Files:
  • M src/html/template/escape_test.go
  • M src/html/template/js.go
Change size: S
Delta: 2 files changed, 16 insertions(+), 0 deletions(-)
Open in Gerrit

Related details

Attention set is empty
Submit Requirements:
  • requirement is not satisfiedCode-Review
  • requirement satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement is not satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: newchange
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I3f2e06496020ece655d156fb099ff556af8cc836
Gerrit-Change-Number: 771180
Gerrit-PatchSet: 1
Gerrit-Owner: Neal Patel <neal...@google.com>
unsatisfied_requirement
satisfied_requirement
open
diffy

Neal Patel (Gerrit)

unread,
Apr 27, 2026, 5:37:34 PM (2 days ago) Apr 27
to goph...@pubsubhelper.golang.org, Roland Shoemaker, golang-co...@googlegroups.com
Attention needed from Roland Shoemaker

Neal Patel voted Commit-Queue+1

Commit-Queue+1
Open in Gerrit

Related details

Attention is currently required from:
  • Roland Shoemaker
Submit Requirements:
  • requirement is not satisfiedCode-Review
  • requirement satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement is not satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I3f2e06496020ece655d156fb099ff556af8cc836
Gerrit-Change-Number: 771180
Gerrit-PatchSet: 1
Gerrit-Owner: Neal Patel <neal...@google.com>
Gerrit-Reviewer: Neal Patel <neal...@google.com>
Gerrit-Reviewer: Roland Shoemaker <rol...@golang.org>
Gerrit-Attention: Roland Shoemaker <rol...@golang.org>
Gerrit-Comment-Date: Mon, 27 Apr 2026 21:37:30 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
unsatisfied_requirement
satisfied_requirement
open
diffy

Neal Patel (Gerrit)

unread,
Apr 28, 2026, 12:47:55 PM (16 hours ago) Apr 28
to goph...@pubsubhelper.golang.org, golang...@luci-project-accounts.iam.gserviceaccount.com, Damien Neil, Roland Shoemaker, golang-co...@googlegroups.com
Attention needed from Roland Shoemaker

Neal Patel voted Commit-Queue+1

Commit-Queue+1
Open in Gerrit

Related details

Attention is currently required from:
  • Roland Shoemaker
Submit Requirements:
  • requirement is not satisfiedCode-Review
  • requirement satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement is not satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I3f2e06496020ece655d156fb099ff556af8cc836
Gerrit-Change-Number: 771180
Gerrit-PatchSet: 2
Gerrit-Owner: Neal Patel <neal...@google.com>
Gerrit-Reviewer: Neal Patel <neal...@google.com>
Gerrit-Reviewer: Roland Shoemaker <rol...@golang.org>
Gerrit-CC: Damien Neil <dn...@google.com>
Gerrit-Attention: Roland Shoemaker <rol...@golang.org>
Gerrit-Comment-Date: Tue, 28 Apr 2026 16:47:51 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
unsatisfied_requirement
satisfied_requirement
open
diffy

Roland Shoemaker (Gerrit)

unread,
Apr 28, 2026, 4:09:06 PM (13 hours ago) Apr 28
to Neal Patel, goph...@pubsubhelper.golang.org, golang...@luci-project-accounts.iam.gserviceaccount.com, Damien Neil, golang-co...@googlegroups.com
Attention needed from Neal Patel

Roland Shoemaker voted Code-Review+2

Code-Review+2
Open in Gerrit

Related details

Attention is currently required from:
  • Neal Patel
Submit Requirements:
  • requirement satisfiedCode-Review
  • requirement satisfiedNo-Unresolved-Comments
  • requirement satisfiedReview-Enforcement
  • requirement satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I3f2e06496020ece655d156fb099ff556af8cc836
Gerrit-Change-Number: 771180
Gerrit-PatchSet: 2
Gerrit-Owner: Neal Patel <neal...@google.com>
Gerrit-Reviewer: Neal Patel <neal...@google.com>
Gerrit-Reviewer: Roland Shoemaker <rol...@golang.org>
Gerrit-CC: Damien Neil <dn...@google.com>
Gerrit-Attention: Neal Patel <neal...@google.com>
Gerrit-Comment-Date: Tue, 28 Apr 2026 20:09:02 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
satisfied_requirement
open
diffy

Neal Patel (Gerrit)

unread,
Apr 28, 2026, 8:53:33 PM (8 hours ago) Apr 28
to goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Roland Shoemaker, golang...@luci-project-accounts.iam.gserviceaccount.com, Damien Neil, golang-co...@googlegroups.com

Neal Patel submitted the change

Change information

Commit message:
html/template: fix escaper bypass by treating empty script type as JavaScript

Thank you to Mundur (https://github.com/M0nd0R) for reporting this issue.

Fixes #78981
Fixes CVE-2026-39826
Change-Id: I3f2e06496020ece655d156fb099ff556af8cc836
Files:
  • M src/html/template/escape_test.go
  • M src/html/template/js.go
Change size: S
Delta: 2 files changed, 16 insertions(+), 0 deletions(-)
Branch: refs/heads/master
Submit Requirements:
Open in Gerrit
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: merged
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I3f2e06496020ece655d156fb099ff556af8cc836
Gerrit-Change-Number: 771180
Gerrit-PatchSet: 3
open
diffy
satisfied_requirement
Reply all
Reply to author
Forward
0 new messages