x/tools/gopls: unsanitized source filename in HTML package documentation

[neild]

The x/tools/gopls/internal/golang/freesymbols package's sourceLink function (https://go.googlesource.com/tools/+/refs/tags/v0.47.0/gopls/internal/golang/freesymbols.go#418) includes an unsanitized filename in HTML output. A malicious package with a filename such as <script>alert(1)</script> can inject XSS into the HTML.

Thanks to sorte for reporting this issue.

This is a PUBLIC track vulnerability and CVE-2026-56856.

[ilindan-dev]

Hi @neild! If there isn't already an internal CL in flight for this CVE, I'd be happy to submit a quick patch using html.EscapeString to sanitize the output. Let me know if I can pick this up!

[adonovan]

Hi @neild! If there isn't already an internal CL in flight for this CVE, I'd be happy to submit a quick patch using html.EscapeString to sanitize the output. Let me know if I can pick this up!

Thanks, but that's not a solution. What is needed is an audit of each act of quotation, and possibly replacement of string logic by the html/template package.

[ilindan-dev]

Thanks for the clarification, Alan! It's clearer now. Indeed, a thorough audit and switching to HTML/templates would be the right solution in this case. I'll leave that to more experienced developers then. Good luck with solving the problem.

[gopherbot]

Change https://go.dev/cl/796260 mentions this issue: gopls/internal/golang: freesymbols: use html/template