html/template: imagesrcset incorrectly escaped

[hoox]

What version of Go are you using (go version)?

$ go version go1.16.6 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What did you do?

• https://play.golang.org/p/-lKXlZo1DXy

What did you expect to see?

• <link rel="preload" as="image" imagesrcset="http://example.com/1.jpg 100w, http://example.com/2.jpg 200w" />

What did you see instead?

• <link rel="preload" as="image" imagesrcset="http://example.com/1.jpg%20100w,%20http://example.com/2.jpg%20200w" />

References

• https://web.dev/preload-responsive-images/#imagesrcset-and-imagesizes
• Related to: html/template: srcset incorrectly escaped #17441

Ta!

[cagedmantis]

#17441 was frozen due to age.

/cc @empijei

[hoox]

#17441 was frozen due to age.

/cc @empijei

FYI, the issue in #17441 no longer occurs as seen in the original go playground: https://play.golang.org/p/8A4TQ1-Kvt

[hoox]

Additional reference spec: https://html.spec.whatwg.org/multipage/semantics.html#attr-link-imagesrcset

[jimmyfrasche]

#17441 added handling for the srcset and sizes attributes on the img tag.

The link tag uses the same formats for the imagesrcset and imagesizes rules, but those are not handled by html/template currently.

Is that a correct summary? Are there other attributes that use the srcset format that should be updated with these?

Looking at https://golang.org/cl/38324 it appears that all that remains is to add "imagesrcset": contentTypeSrcset, and "imagesizes": contentTypePlain, to the map in attr.go, but I am not an expert at html/template.

cc @golang/security per golang.org/s/owners