Skip to content

v0.62.0

v0.62.0: html: check all ancestor namespace transitions when rendering raw text
@jitsu-net jitsu-net tagged this 27 Oct 19:00 
In childTextNodesAreLiteral, walking up the tree previously stopped at
the nearest foreign ancestor once an HTML integration point was found.
However, that integration point may itself be a descendant of an element
that was foster-parented into a foreign namespace (such as <mglyph> or
<malignmark> fostered under <mtext>), causing a parser to resolve the
subtree in a different foreign namespace upon re-parsing the rendered
output.

Continue walking the full ancestor chain and verify that every
transition from a non-empty namespace occurs at an HTML integration
point before emitting literal text.

Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276)
for reporting this issue.

Fixes CVE-2026-97045
For golang/go#82622

Change-Id: I67d0006dce9023451905d8e96c4d1f3d05e769cc
Reviewed-on: https://go-internal-review.googlesource.com/c/net/+/6360
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-on: https://go-review.googlesource.com/c/net/+/855121
Reviewed-by: Neal Patel <neal@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Gopher Robot <gobot@golang.org>
Assets 2
Loading