html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318) [1.21 backport]

[gopherbot]

The html/template package did not properly handle HMTL-like ""
comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may
cause the template parser to improperly interpret the contents of <script>
contexts, causing actions to be improperly escaped. This could be leveraged to
perform an XSS attack.

Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this
issue.

This is CVE-2023-39318 and Go issue https://go.dev/issue/62196.

---

@rolandshoemaker requested issue #62196 to be considered for backport to the next 1.21 minor release.

@gopherbot please open backport issues.

[gopherbot]

Change https://go.dev/cl/526096 mentions this issue: [release-branch.go1.21] html/template: support HTML-like comments in script contexts

[gopherbot]

Closed by merging b0e1d3e to release-branch.go1.21.