Unescape css input to HTML

How to make unescape html?

I am passing the css file to html like this

<style>{{.file}}</style> 

I get it

 <style>ZgotmplZ</style> 

I tried wrapping the field using the .HTML (data) template, did not work.

+2
source share
1 answer

The Go HTML template package provides CSS correctly. Quoting from the template package documentation :

Escaping is contextual, so actions can appear in JavaScript, CSS, and URI contexts.

"ZgotmplZ" is a special value, it is used as a replacement if the value you are trying to include is invalid or insecure in context.

So the problem is that the CSS value you are trying to include is unsafe. First try something simple and see if it works, for example:

 body {background-color: #000} 

Found a discussion of "ZgotmplZ" in the documentation (by type ErrorCode ), citing it:

"ZgotmplZ" explanation:

Template example:

 <img src="{{.X}}"> where {{.X}} evaluates to `javascript:...` 

Discussion:

 "ZgotmplZ" is a special value that indicates that unsafe content reached a CSS or URL context at runtime. The output of the example will be <img src="#ZgotmplZ"> If the data comes from a trusted source, use content types to exempt it from filtering: URL(`javascript:...`). 

Decision

Since the code you are trying to paste is in the context of the CSS code, not HTML, you cannot / should not use template.HTML(data) .

There is a predefined CSS type for safely incorporating CSS code coming from a trusted source, for example. The CSS code you specify does not come from an HTML form populated by the user. Example:

 var safeCss = template.CSS(`body {background-image: url("paper.gif");}`) 

And pass the safeCss value safeCss your template parameter.

+3
source

All Articles