diff --git a/src/html/template/escape.go b/src/html/template/escape.go index 23ece7a72f..c262d1698d 100644 --- a/src/html/template/escape.go +++ b/src/html/template/escape.go @@ -381,9 +381,8 @@ func normalizeEscFn(e string) string { // for all x. var redundantFuncs = map[string]map[string]bool{ "_html_template_commentescaper": { - "_html_template_attrescaper": true, - "_html_template_nospaceescaper": true, - "_html_template_htmlescaper": true, + "_html_template_attrescaper": true, + "_html_template_htmlescaper": true, }, "_html_template_cssescaper": { "_html_template_attrescaper": true, diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go index 3dd212bac9..f8b2b448f2 100644 --- a/src/html/template/escape_test.go +++ b/src/html/template/escape_test.go @@ -678,6 +678,21 @@ func TestEscape(t *testing.T) { ``, ``, }, + { + "unquoted empty attribute value (plaintext)", + "

", + "

", + }, + { + "unquoted empty attribute value (url)", + "

", + "

", + }, + { + "quoted empty attribute value", + "

", + "

", + }, } for _, test := range tests { diff --git a/src/html/template/html.go b/src/html/template/html.go index bcca0b51a0..a181699a5b 100644 --- a/src/html/template/html.go +++ b/src/html/template/html.go @@ -14,6 +14,9 @@ import ( // htmlNospaceEscaper escapes for inclusion in unquoted attribute values. func htmlNospaceEscaper(args ...any) string { s, t := stringify(args...) + if s == "" { + return filterFailsafe + } if t == contentTypeHTML { return htmlReplacer(stripTags(s), htmlNospaceNormReplacementTable, false) }