text/template: protect against explicit nil in field chains

An explicit nil in an expression like nil.Foo caused a panic
because the evaluator attempted to reflect on the nil.
A typeless nil like this cannot be used to do anything, so
just error out.

Fixes #9426

Change-Id: Icd2c9c7533dda742748bf161eced163991a12f54
Reviewed-on: https://go-review.googlesource.com/7643Reviewed-by: David Symonds <dsymonds@golang.org>

src/text/template/exec.go

@@ -418,11 +418,14 @@ func (s *state) evalFieldNode(dot reflect.Value, field *parse.FieldNode, args []
 
 func (s *state) evalChainNode(dot reflect.Value, chain *parse.ChainNode, args []parse.Node, final reflect.Value) reflect.Value {
 	s.at(chain)
-	// (pipe).Field1.Field2 has pipe as .Node, fields as .Field. Eval the pipeline, then the fields.
-	pipe := s.evalArg(dot, nil, chain.Node)
 	if len(chain.Field) == 0 {
 		s.errorf("internal error: no fields in evalChainNode")
 	}
+	if chain.Node.Type() == parse.NodeNil {
+		s.errorf("indirection through explicit nil in %s", chain)
+	}
+	// (pipe).Field1.Field2 has pipe as .Node, fields as .Field. Eval the pipeline, then the fields.
+	pipe := s.evalArg(dot, nil, chain.Node)
 	return s.evalFieldChain(dot, pipe, chain, chain.Field, args, final)
 }
 

src/text/template/exec_test.go

@@ -527,6 +527,8 @@ var execTests = []execTest{
 	{"bug12XE", "{{printf `%T` 0XEE}}", "int", T{}, true},
 	// Chained nodes did not work as arguments. Issue 8473.
 	{"bug13", "{{print (.Copy).I}}", "17", tVal, true},
+	// Didn't protect against explicit nil in field chains.
+	{"bug14", "{{nil.True}}", "", tVal, false},
 }
 
 func zeroArgs() string {