html/template: iframe srcdoc attribute not properly escaped

[rolandshoemaker]

If an action is placed in an iframe srcdoc attribute, its content is not properly treated as HTML and escaped.

I believe this just needs adding the right case in tTag.

This can cause unexpected content to be rendered. Due to a lack of usage of this attribute in templates that we could find, and since it would require the template author to explicitly place attacker controlled input into an action in srcdoc, which seems quite unlikely, we are treating this as a security hardening issue.

[gopherbot]

Change https://go.dev/cl/794481 mentions this issue: html/template: double-encode dynamic values in srcdoc attributes

[gopherbot]

Change https://go.dev/cl/794660 mentions this issue: html/template: harden srcdoc and SVG URL attributes