Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
html/template: does not recognize rgb() as a CSS color #25446
Please answer these questions before submitting your issue. Thanks!
What version of Go are you using (
changed the title from
bug: html template does not recognize rgb() as a CSS color
html/template: does not recognize rgb() as a CSS color
May 17, 2018
(a better way may be find css standards)
I don't think encouraging people to use
I agree that
The tests (code) give a sense of what is currently recognized.
@mikesamuel - one approach to fix this is to figure out if the value is a safe CSS function call. If it is, then we'll have to make sure the function call is of a valid syntax. Do we have a parser somewhere which I can use?
If you had other thoughts, please let me know.
Switching to a parser to allow certain functions would imply a complete rewrite of that logic, and would very likely introduce issues and potential vulnerabilities in code that is currently protected by that check (e.g. existing code with a globally defined and vulnerable
I don't think switching to an allowed-list can be easily done in a secure way, and would probably not be considered backward compatible.