白名单标签免于使用Go的html / template进行转义

Question

Pass a []byte into a template as the body of a message post on a forum-style web app. In the template, call a method to convert to string and along the way, switch out all newlines for line breaks:

<p>{{.BodyString}}</p>

...

func (p *Post) BodyString() string {
    nl := regexp.MustCompile(`
`)
    return nl.ReplaceAllString(string(p.Body), `<br>`)
}

What you'll end up with:

paragraphs <br> <br>in <br> <br>this <br> <br>post

I don't want to pass the entire post in with HTML(p.Body), as it represents third party data from potentially untrustworthy sources. Is there a way to whitelist only some tags for formatting purposes using the vanilla Go1 template package?

Answer 1

I do think you want to parse the HTML. The HTML parser in exp/html was deemed incomplete and so removed from Go 1, although the exp tree is still in the Go source tree and can be accessed by weekly tag, for example. I don't know exactly what is incomplete. I used it for a simple task once and it met my needs.

Also of course, check the dashboard and see related SO post, Any smart method to get exp/html back after Go1?, mostly for the recomendation of http://code.google.com/p/go-html-transform/