• Michael Kelly's avatar
    net/http: escape contents of the directory indexes generated by FileServer · 26cc1028
    Michael Kelly authored
          Previously, filenames containing special characters could:
          1) Escape the <a> tag, with a file called something like: ">foo
          2) Break the links in the index by prematurely ending the path portion
          of the url, with a file called: foo?bar
    
          In order to avoid a forbidden dependency on the html package, I'm
          using htmlReplacer from net/http/server.go, which is equivalent to
          html.EscapeString.
    
          This change also expands fakeFile.Readdir to better emulate
    os.File.Readdir.
    
    R=golang-codereviews, rsc, gobot, bradfitz, josharian, mikioh.mikioh
    CC=golang-codereviews
    https://golang.org/cl/37440043
    26cc1028
fs.go 15.5 KB