From patchwork Mon Aug 31 06:14:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 96885 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B4F0EC624A5 for ; Mon, 31 Aug 2026 06:15:02 +0000 (UTC) Received: from alln-iport-4.cisco.com (alln-iport-4.cisco.com [173.37.142.91]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.23738.1788156894346874585 for ; Sun, 30 Aug 2026 23:14:54 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=jPz3r7bc; spf=pass (domain: cisco.com, ip: 173.37.142.91, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3003; q=dns/txt; s=iport01; t=1788156894; x=1789366494; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=aW5GsAfVLdfsBlyOkvq7EGKXFDn/RB1v6iS0Vci4pmw=; b=jPz3r7bcRrzxr8BdFJjp/8GkPVFsauIsGpKbeDg0NKjB8aOwRov5tKR4 JLMCyqDl/ocO+yvrKeDLAwX/ob8kAXg5ZFCcqYCWgYouwyyk1OZj2uFUc H2srJa890WUjlOgtfWElniA7p5gs8lF5RR7Kb0ho56JFSGs0c1IXVahyT aFp6spXLfWNv65mmpB+ep+AWB93qpjNKy9P28VG0/fzfEr4lujEFKPYUf n2xxJtIZIt85gqKFbLVShQMgdwWQ/DaZxEJRNMMe6RY7x0LXTBW9ewzu4 5g9DvhP/zOqk8S+VNmQ70tqX05xgNyifGsfllWSAOvSoJ8CrN9gNcVYKH Q==; X-CSE-ConnectionGUID: KO30/a1xRTG0zTRKmCuwrg== X-CSE-MsgGUID: ALBmtqZcSJua4kzxscHZsw== X-IPAS-Result: A0CBSQDSGpVq/40QJK1aglmCV3RfQkmWSp4egSQDA1QPAQEBD0QNBAEBhQWNdQImNAkOAQIEAwIDAQEBAQEBAQEBAQELAQEFAQEBAgEHBYEOE4ZPDYZaAQIBNQFGLAMBAlojIYMCAYJ0AgERwh6CLIEBg2IBgRrbMAELFAEFgTOFP4giXRgBhHwnGxuBcoR+gQWBXAKCLYV4BIIigQyBWpIfSIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4ENGwYFgR2BKIQPIxk2eoEJXoErKWABEheBCYIIAoJaggUCAUlDDgdHUwkECxgNSBEsNxUZBD5uB456H4JEBgF7EwEqAYIEDwE6k1qReqEPCiiDdowilToaM4QEpmgLmH2CWYsxiHiNWIRpgWg8OYEgcBWDIglKGQ+OOINrgkrJbyQ1CzIBAQcCBw4DC4FokAItgU8BAQ IronPort-Data: A9a23:aIsd36+G0LZ84gAq33LaDrUD13+TJUtcMsCJ2f8bNWPcYEJGY0x3z 2ofCm7QOfjfZzemfdAjPISyox8O6pTTyIdrTABoqX1EQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmE4EzrauS9xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mvyyHjEAX9gWAsYjlMs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2kVGtZAve8uEVty2 qQKFAouazuemPi5lefTpulE3qzPLeHiOIcZ/3UlxjbDALN+HdbIQr7B4plT2zJYasJmRKmFI ZFHL2MxKk2cOnWjOX9PYH46tOe0hnD8eidwo1OOrq1x6G/WpOB0+Oi3bIeOJoLbHq25mG6xg kjD433LCSo4KdXDyiiV6XmMtPTQyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc9NUF+t/7ESGzbDZpl7FQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSj1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:PWGVqaMm/EjlvcBcTu2jsMiBIKoaSvp037Dk7S9MoHtuA6mlfq +V/cjzuSWYtN9zYgBDpTn/Asm9qBrnnPYfi7X5Vo3NYOCJggeVxahZnO/fKkXbak7D398Y87 t8eK5jD9C1J117gcHmpDScKb8bsb66GGTCv5am85+rJjsaDZ1d0w== X-Talos-CUID: 9a23:Wx1cTmGDF+37lRC5qmJE0xVMXcl8Ykfh4y/CH3WbDE10V6eaHAo= X-Talos-MUID: 9a23:EEwIag1bgrke4VDxnPL2ChCZITUjyoCEDVwUo549mdSNaS9iKyyWrAasXdpy X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,252,1779148800"; d="scan'208";a="824534693" Received: from alln-l-core-04.cisco.com ([173.36.16.141]) by alln-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 31 Aug 2026 06:14:53 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by alln-l-core-04.cisco.com (Postfix) with ESMTPS id 675A518000188; Mon, 31 Aug 2026 06:14:53 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id 02501CE1C04; Sun, 30 Aug 2026 23:14:52 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Hetvi Thakar Subject: [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814 Date: Sun, 30 Aug 2026 23:14:46 -0700 Message-Id: <20260831061447.180612-1-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: alln-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 31 Aug 2026 06:15:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244730 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f [2] https://pkg.go.dev/vuln/GO-2026-4918 Signed-off-by: Hetvi Thakar --- meta/recipes-devtools/go/go-1.22.12.inc | 1 + .../go/go/CVE-2026-33814.patch | 44 +++++++++++++++++++ 2 files changed, 45 insertions(+) create mode 100644 meta/recipes-devtools/go/go/CVE-2026-33814.patch diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc index 99c5f8b63b..ee2f5ca277 100644 --- a/meta/recipes-devtools/go/go-1.22.12.inc +++ b/meta/recipes-devtools/go/go-1.22.12.inc @@ -62,6 +62,7 @@ SRC_URI += "\ file://CVE-2026-25679.patch \ file://CVE-2026-32288.patch \ file://CVE-2026-27145.patch \ + file://CVE-2026-33814.patch \ " SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71" diff --git a/meta/recipes-devtools/go/go/CVE-2026-33814.patch b/meta/recipes-devtools/go/go/CVE-2026-33814.patch new file mode 100644 index 0000000000..8265bf205f --- /dev/null +++ b/meta/recipes-devtools/go/go/CVE-2026-33814.patch @@ -0,0 +1,44 @@ +From 825d42a14d8ffbdbdda87a39e78795eb17e4f0f2 Mon Sep 17 00:00:00 2001 +From: Mark Freeman +Date: Fri, 17 Apr 2026 16:28:03 -0400 +Subject: [PATCH] [release-branch.go1.25] all: update x/net to a9171bc8 + +Fixes #78477 + +Change-Id: I0a4c8e25f569fc1bfb8ac39ff728bfe7300b751f +Reviewed-on: https://go-review.googlesource.com/c/go/+/768323 +Reviewed-by: Dmitri Shuralyov +TryBot-Bypass: Dmitri Shuralyov + +CVE: CVE-2026-33814 +Upstream-Status: Backport [https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f] + +Backport Changes: +- Omitted src/go.mod, src/go.sum, and src/vendor/modules.txt because + their x/net version updates are not required for this focused backport. +- Omitted removal of the SETTINGS_ENABLE_CONNECT_PROTOCOL-specific + s.Valid call because Go 1.22 does not contain that setting case; validation + is added at the start of the settings callback instead. + +(cherry picked from commit 9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f) +Signed-off-by: Hetvi Thakar +--- + src/net/http/h2_bundle.go | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/net/http/h2_bundle.go b/src/net/http/h2_bundle.go +index c1a2e76ea4d..2f5a6d3d5a2 100644 +--- a/src/net/http/h2_bundle.go ++++ b/src/net/http/h2_bundle.go +@@ -9910,6 +9910,9 @@ func (rl *http2clientConnReadLoop) processSettingsNoWrite(f *http2SettingsFrame) + + var seenMaxConcurrentStreams bool + err := f.ForeachSetting(func(s http2Setting) error { ++ if err := s.Valid(); err != nil { ++ return err ++ } + switch s.ID { + case http2SettingMaxFrameSize: + cc.maxFrameSize = s.Val +-- +2.35.6 From patchwork Mon Aug 31 06:14:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 96886 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A49A4C61DD3 for ; Mon, 31 Aug 2026 06:15:02 +0000 (UTC) Received: from alln-iport-4.cisco.com (alln-iport-4.cisco.com [173.37.142.91]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.23738.1788156894346874585 for ; Sun, 30 Aug 2026 23:14:59 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=YdjRcNHf; spf=pass (domain: cisco.com, ip: 173.37.142.91, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5399; q=dns/txt; s=iport01; t=1788156899; x=1789366499; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Iy4imFrde3jc7hkr2qbyOE7HP5LIe5fmc4K+pjhf+Rk=; b=YdjRcNHfCZyu8BCLOdx0zQHAcI5/r7iBtNONrcsTvtDG2DsQ8s/rIOeK qjehJ/IAzu1KwQrkzqbrWWS+S3x2SWvwozBsnM13lgX50HhLrdUSOGaZD UwYPyvmssWvL4MLwDAqlbv4M+93JDZPnSY+5Drc4JCtC8MEbPC4GZblkL YZwHz4zaeLKmsW5GNyCOC7pZHqDZ4sv9zk+U9rZg70kVYBVln6Rwn358T oixqzSZSsHPDFIwguXOFMokP2rqOe+R14PF6eGYVWdzjxTeX6AI7sPmlS RaCEtNMYc5r2rze4To+tmFN4E1i4TJNWr3aRkwxsSzHrdrL+M6WPoisK4 Q==; X-CSE-ConnectionGUID: CY1gRkP3TbWh1k6+uyfOWQ== X-CSE-MsgGUID: msqogOqZSPWQpSKRClVqMQ== X-IPAS-Result: A0BLAgDSGpVq/4sQJK1aHgEBCxIMggULgld0X0JJA4RUkXMDnhuBGwMGA1cPAQEBD0QNBAEBhQUCjXMCJjQJDgECBAMCAwEBAQEBAQEBAQEBCwEBBQEBAQIBBwWBDhOGTw2GWgECAQMjDwFGEBwDAQIDAiYCAisjCBAJgwIBgnQCARHCHnqBMoEBg2IBgRrbMAEFBhQBBYEFLoU/gx8BhQJdGAGEfCcbG4FygRWDaYEFgVwChTuCagSCDRWBDIFagmuDRotuSIECHANZLAFVEw0KCwcFgWYDNRIqFW4yHYEjPhc1WBsGBYEdgSiEDyMZNnqBCV6BKylgARIXgQmCCAKCWoIFAgFJQw4HR1MJBAsYDUgRLDcVGQQ9AW4HjnofgUcsVwGBDgEpAQEggXMBJ6VnoQ8KKIN2jCKVOhozqmwLmH2OCpZQhGmBaDw5gSBwFYMiUxkPjioOC4NgzDkkNQIEBTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:wtDdFKD+dVal6xVW/37iw5YqxClBgxIJ4kV8jS/XYbTApG53gzBRm zcdXmqGaKvZZmP8eNEjaN/n/R5Xv5aBx983OVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGdIZvCCeA+n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXmthh fuo+5eBYA/+g2YtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE6MQ3A3s1BdYk8Nl3WGIQt uEJJhcyV0XW7w626OrTpuhEj8AnKozveYgYoHwllWufBvc9SpeFSKLPjTNa9G5v3YYVQ7CHO YxAMmsHgBfoO3WjPn8XFJI3n+6yrnL+aDZf7lmSoMLb5kCDllAsi+SybIW9ltqiQN5MmUm/v 1D9x1vAGio5Dveb9yOgyyf57gPItWahMG4IL5W/7vNsjViZy2AfBRFTXlyhrNG9i1WiQJRYM 0ES9y8koKQ++UDtScPyNyBUu1aNuhoaHt4VGOog5UTVkOzf4h2SAS4PSTsphMEaifLajAcCj jeh9+4FzxQ12FFJYRpxLoupkA4= IronPort-HdrOrdr: A9a23:dLmtuK6WXNmxZTp0VwPXwBbXdLJyesId70hD6qm+c3Nom6uj5q aTdZUgpHjJYVkqOU3I9ersBEDEewK/yXcX2/h0AV7dZmnbUQKTRekIh7cKgQeQfhEWndQy6U 4PScRD4fTLfCFHZL7BkWqFOudl5sWb+6a1guqb5XJsQQZ2L5xE1W5Ce36m+okcfng9OXL/f6 DsnfZ6mw== X-Talos-CUID: 9a23:RQRhtGOFDZprQ+5Dcxg++3QXIpsZeELdlXSOYFKpB0FWcejA X-Talos-MUID: 9a23:Kp77HQbWDV7tGOBTsiT1gz5FLfVT25uXEHsuq74ChdChDHkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,252,1779148800"; d="scan'208";a="824534747" Received: from alln-l-core-02.cisco.com ([173.36.16.139]) by alln-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 31 Aug 2026 06:14:58 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by alln-l-core-02.cisco.com (Postfix) with ESMTPS id 85AEB180000B0; Mon, 31 Aug 2026 06:14:58 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id 23371CE1C04; Sun, 30 Aug 2026 23:14:58 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Hetvi Thakar Subject: [OE-core][scarthgap][PATCH 2/2] go: Fix CVE-2026-39823 Date: Sun, 30 Aug 2026 23:14:47 -0700 Message-Id: <20260831061447.180612-2-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260831061447.180612-1-hthakar@cisco.com> References: <20260831061447.180612-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: alln-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 31 Aug 2026 06:15:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244731 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/golang/go/commit/f0384f7c664892ed3ee8c0fec68638d9b3b01811 [2] https://pkg.go.dev/vuln/GO-2026-4982 Signed-off-by: Hetvi Thakar --- meta/recipes-devtools/go/go-1.22.12.inc | 1 + .../go/go/CVE-2026-39823.patch | 100 ++++++++++++++++++ 2 files changed, 101 insertions(+) create mode 100644 meta/recipes-devtools/go/go/CVE-2026-39823.patch diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc index ee2f5ca277..a2c0efa378 100644 --- a/meta/recipes-devtools/go/go-1.22.12.inc +++ b/meta/recipes-devtools/go/go-1.22.12.inc @@ -63,6 +63,7 @@ SRC_URI += "\ file://CVE-2026-32288.patch \ file://CVE-2026-27145.patch \ file://CVE-2026-33814.patch \ + file://CVE-2026-39823.patch \ " SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71" diff --git a/meta/recipes-devtools/go/go/CVE-2026-39823.patch b/meta/recipes-devtools/go/go/CVE-2026-39823.patch new file mode 100644 index 0000000000..00e25bb35c --- /dev/null +++ b/meta/recipes-devtools/go/go/CVE-2026-39823.patch @@ -0,0 +1,100 @@ +From 4915efb53a017a136a233a7676e80858d5b6e560 Mon Sep 17 00:00:00 2001 +From: Neal Patel +Date: Wed, 22 Apr 2026 18:41:25 -0400 +Subject: [PATCH] [release-branch.go1.25] html/template: fix escaping of URLs + in meta content attributes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The WHATWG "shared declarative refresh steps" algorithm (ยง4.2.5.3) +skips ASCII whitespace between "url" and "=" when parsing the URL +portion of a meta content attribute. + +Thank you to Samy Ghannad for reporting this issue. + +Updates #78913 +Fixes #79031 +Fixes CVE-2026-39823 + +Change-Id: I7fc3bb9394b95e07b9b10fbc95725a3de6791774 +Reviewed-on: https://go-review.googlesource.com/c/go/+/769920 +Reviewed-by: Roland Shoemaker +TryBot-Bypass: Roland Shoemaker +(cherry picked from commit f2ec1254ff32fa39f3ce4faf72bbe44eeeeebad9) +Reviewed-on: https://go-review.googlesource.com/c/go/+/772101 +LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com + +CVE: CVE-2026-39823 +Upstream-Status: Backport [https://github.com/golang/go/commit/f0384f7c664892ed3ee8c0fec68638d9b3b01811] + +(cherry picked from commit f0384f7c664892ed3ee8c0fec68638d9b3b01811) +Signed-off-by: Hetvi Thakar +--- + src/html/template/escape_test.go | 20 ++++++++++++++++++++ + src/html/template/transition.go | 12 +++++++----- + 2 files changed, 27 insertions(+), 5 deletions(-) + +diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go +index ce064407384..c9e566a9076 100644 +--- a/src/html/template/escape_test.go ++++ b/src/html/template/escape_test.go +@@ -759,6 +759,26 @@ func TestEscape(t *testing.T) { + ``, + ``, + }, ++ { ++ "meta content url with whitespace before equals", ++ ``, ++ ``, ++ }, ++ { ++ "meta content url with tab before equals", ++ "", ++ "", ++ }, ++ { ++ "meta content url with space after equals", ++ ``, ++ ``, ++ }, ++ { ++ "meta content url with whitespace both sides of equals", ++ "", ++ "", ++ }, + } + + for _, test := range tests { +diff --git a/src/html/template/transition.go b/src/html/template/transition.go +index 5aa3c35440b..ac05d56b418 100644 +--- a/src/html/template/transition.go ++++ b/src/html/template/transition.go +@@ -626,10 +626,12 @@ func tError(c context, s []byte) (context, int) { + + // tMetaContent is the context transition function for the meta content attribute state. + func tMetaContent(c context, s []byte) (context, int) { +- for i := 0; i < len(s); i++ { +- if i+3 <= len(s)-1 && bytes.Equal(bytes.ToLower(s[i:i+4]), []byte("url=")) { +- c.state = stateMetaContentURL +- return c, i + 4 ++ for i := range len(s) { ++ if i+3 <= len(s)-1 && bytes.EqualFold(s[i:i+3], []byte("url")) { ++ if j := eatWhiteSpace(s, i+3); j < len(s) && s[j] == '=' { ++ c.state = stateMetaContentURL ++ return c, j + 1 ++ } + } + } + return c, len(s) +@@ -637,7 +639,7 @@ func tMetaContent(c context, s []byte) (context, int) { + + // tMetaContentURL is the context transition function for the "url=" part of a meta content attribute state. + func tMetaContentURL(c context, s []byte) (context, int) { +- for i := 0; i < len(s); i++ { ++ for i := range len(s) { + if s[i] == ';' { + c.state = stateMetaContent + return c, i + 1 +-- +2.35.6