Rietveld Code Review Tool
Help | Bug tracker | Discussion group | Source code | Sign in
(317)

Side by Side Diff: src/pkg/html/template/content.go

Issue 5437061: code review 5437061: html/template: fix documentation indent (Closed)
Patch Set: diff -r 41974a4eed1f https://go.googlecode.com/hg Created 13 years, 3 months ago
Left:
Right:
Use n/p to move between diff chunks; N/P to move between comments. Please Sign in to add in-line comments.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2011 The Go Authors. All rights reserved. 1 // Copyright 2011 The Go Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style 2 // Use of this source code is governed by a BSD-style
3 // license that can be found in the LICENSE file. 3 // license that can be found in the LICENSE file.
4 4
5 package template 5 package template
6 6
7 import ( 7 import (
8 "fmt" 8 "fmt"
9 "reflect" 9 "reflect"
10 ) 10 )
11 11
12 // Strings of content from a trusted source. 12 // Strings of content from a trusted source.
13 type ( 13 type (
14 // CSS encapsulates known safe content that matches any of: 14 // CSS encapsulates known safe content that matches any of:
15 » // (1) The CSS3 stylesheet production, such as `p { color: purple }`. 15 » // 1. The CSS3 stylesheet production, such as `p { color: purple }`.
16 » // (2) The CSS3 rule production, such as `a[href=~"https:"].foo#bar`. 16 » // 2. The CSS3 rule production, such as `a[href=~"https:"].foo#bar`.
17 » // (3) CSS3 declaration productions, such as `color: red; margin: 2px`. 17 » // 3. CSS3 declaration productions, such as `color: red; margin: 2px`.
18 » // (4) The CSS3 value production, such as `rgba(0, 0, 255, 127)`. 18 » // 4. The CSS3 value production, such as `rgba(0, 0, 255, 127)`.
19 // See http://www.w3.org/TR/css3-syntax/#style 19 // See http://www.w3.org/TR/css3-syntax/#style
20 CSS string 20 CSS string
21 21
22 // HTML encapsulates a known safe HTML document fragment. 22 // HTML encapsulates a known safe HTML document fragment.
23 // It should not be used for HTML from a third-party, or HTML with 23 // It should not be used for HTML from a third-party, or HTML with
24 // unclosed tags or comments. The outputs of a sound HTML sanitizer 24 // unclosed tags or comments. The outputs of a sound HTML sanitizer
25 // and a template escaped by this package are fine for use with HTML. 25 // and a template escaped by this package are fine for use with HTML.
26 HTML string 26 HTML string
27 27
28 // HTMLAttr encapsulates an HTML attribute from a trusted source, 28 // HTMLAttr encapsulates an HTML attribute from a trusted source,
29 // for example: ` dir="ltr"`. 29 // for example: ` dir="ltr"`.
30 HTMLAttr string 30 HTMLAttr string
31 31
32 // JS encapsulates a known safe EcmaScript5 Expression, or example, 32 // JS encapsulates a known safe EcmaScript5 Expression, or example,
33 // `(x + y * z())`.· 33 // `(x + y * z())`.·
34 // Template authors are responsible for ensuring that typed expressions 34 // Template authors are responsible for ensuring that typed expressions
35 // do not break the intended precedence and that there is no 35 // do not break the intended precedence and that there is no
36 // statement/expression ambiguity as when passing an expression like 36 // statement/expression ambiguity as when passing an expression like
37 // "{ foo: bar() }\n['foo']()", which is both a valid Expression and a 37 // "{ foo: bar() }\n['foo']()", which is both a valid Expression and a
38 // valid Program with a very different meaning. 38 // valid Program with a very different meaning.
39 JS string 39 JS string
40 40
41 // JSStr encapsulates a sequence of characters meant to be embedded 41 // JSStr encapsulates a sequence of characters meant to be embedded
42 // between quotes in a JavaScript expression. 42 // between quotes in a JavaScript expression.
43 // The string must match a series of StringCharacters: 43 // The string must match a series of StringCharacters:
44 » // StringCharacter :: SourceCharacter but not `\` or LineTerminator 44 » // StringCharacter :: SourceCharacter but not `\` or LineTerminator
45 » // | EscapeSequence 45 » // | EscapeSequence
46 // Note that LineContinuations are not allowed. 46 // Note that LineContinuations are not allowed.
47 // JSStr("foo\\nbar") is fine, but JSStr("foo\\\nbar") is not. 47 // JSStr("foo\\nbar") is fine, but JSStr("foo\\\nbar") is not.
48 JSStr string 48 JSStr string
49 49
50 // URL encapsulates a known safe URL as defined in RFC 3896. 50 // URL encapsulates a known safe URL as defined in RFC 3896.
51 // A URL like `javascript:checkThatFormNotEditedBeforeLeavingPage()` 51 // A URL like `javascript:checkThatFormNotEditedBeforeLeavingPage()`
52 // from a trusted source should go in the page, but by default dynamic 52 // from a trusted source should go in the page, but by default dynamic
53 // `javascript:` URLs are filtered out since they are a frequently 53 // `javascript:` URLs are filtered out since they are a frequently
54 // exploited injection vector. 54 // exploited injection vector.
55 URL string 55 URL string
(...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after
104 return string(s), contentTypeJSStr 104 return string(s), contentTypeJSStr
105 case URL: 105 case URL:
106 return string(s), contentTypeURL 106 return string(s), contentTypeURL
107 } 107 }
108 } 108 }
109 for i, arg := range args { 109 for i, arg := range args {
110 args[i] = indirect(arg) 110 args[i] = indirect(arg)
111 } 111 }
112 return fmt.Sprint(args...), contentTypePlain 112 return fmt.Sprint(args...), contentTypePlain
113 } 113 }
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
RSS Feeds Recent Issues | This issue
This is Rietveld f62528b