Skip to content

check_error.go uses html/template, corrupting JSON API error messages #197

Description

@cinar

Problem

check_error.go imports html/template and uses it to render localized error messages:

import "html/template"
...
tmpl, err := template.New("error").Parse(getLocalizedErrorMessage(locale, c.Code))

html/template contextually auto-escapes its output for safe embedding in HTML. For a library whose primary consumer is a JSON API error body (CheckErrors.JSON()), this means any error data containing <, >, &, or " — for example a regex pattern or a user-supplied value echoed into an error message via template data — gets corrupted into &lt;, &gt;, &amp;, &quot; in the JSON payload.

Fix

Switch the import to text/template, which performs no such escaping and is the correct choice for plain-text/JSON message rendering.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions