html/template: Go 1.8 has a different encoding logic for application/ld+json and text/javascript

[ARolek]

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

1.8.3

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN="/Users/arolek/Dev/active/go/bin"
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/arolek/Dev/active/go"
GORACE=""
GOROOT="/usr/local/go"
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/vn/7h5q9_3d19jg95pw_tbdwspr0000gn/T/go-build069492838=/tmp/go-build -gno-record-gcc-switches -fno-common"
CXX="clang++"
CGO_ENABLED="1"
PKG_CONFIG="pkg-config"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"

What did you do?

• Tested this script

What did you expect to see?

• The JSON output to not be escaped when inside of <script type="application/ld+json"> when using template.JS.

What did you see instead?

• The JSON output was escaped when inside of <script type="application/ld+json"> when using template.JS

I believe this is a similar issue to #18159 and that application/ld+json needs to be added to the isJSType mime type list.

[odeke-em]

/cc @nodirt @rsc @mikesamuel

[odeke-em]

Regression from Go1.7 but it was not fixed in Go1.8, am wondering what milestone we should triage this bug for, @bradfitz.

[mikesamuel]

The operative part of the code is src/htm/template/escape.go:711

	// If this is a non-JS "type" attribute inside "script" tag, do not treat the contents as JS.
  	if c.state == stateAttr && c.element == elementScript && c.attr == attrScriptType && !isJSType(string(s[:i])) {
  		element = elementNone
  	}

We'd need to update the list in js.go:382

	case
  		"application/ecmascript",
  		"application/javascript",
  		"application/json",
  		"application/x-ecmascript",
  		"application/x-javascript",
  		"text/ecmascript",
  		"text/javascript",
  		"text/javascript1.0",
  		"text/javascript1.1",
  		"text/javascript1.2",
  		"text/javascript1.3",
  		"text/javascript1.4",
  		"text/javascript1.5",
  		"text/jscript",
  		"text/livescript",
  		"text/x-ecmascript",
  		"text/x-javascript":
  		return true

[mikesamuel]

Do we need to skip the parentheses around the encoded map in your example code?

IIRC, interpolating a map into a script context will wrap in parentheses to avoid the problem noted in EcmaScript 6 Sec 13.5

13.5 Expression Statement

Syntax

ExpressionStatement_[Yield] :

• [lookahead ∉ {{, function, class, let ]}] Expression_{[In, ?Yield]} ;

NOTE An ExpressionStatement cannot start with a U+007B (LEFT CURLY BRACKET) because that might make it ambiguous with a Block.

[ALTree]

@odeke-em I'd say go1.10. Doubt that something that was already broken in go1.8 will be fixed for 1.9, at this point go1.9 is done.

[rsc]

For better or worse, the Go1.8+ behavior is now the de facto expected behavior.