html/template: should escape JSON without using \x #33671
Description
What version of Go are you using (go version)?
go version go1.12.7 darwin/amd64
Does this issue reproduce with the latest release?
Yes.
What did you do?
Ran this snippet
package main
import (
"html/template"
"log"
"os"
)
func main() {
const tpl = `<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>{{ .Title }}</title>
</head>
<body>
<script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "WebPage",
"name":"{{ .Title }}",
"description": "{{ .Description }}"
}
</script>
</body>
</html>`
check := func(err error) {
if err != nil {
log.Fatal(err)
}
}
t, err := template.New("webpage").Parse(tpl)
check(err)
data := struct {
Title, Description string
}{
Title: "<My \"Cool\" Page>",
Description: "A \"Cool\" Page by 'Me'",
}
err = t.Execute(os.Stdout, data)
check(err)
}What did you expect to see?
An HTML document containing valid JSON.
What did you see instead?
Invalid JSON, as reported by https://search.google.com/structured-data/testing-tool/
Go escapes what is between the <script> tags as though it were JavaScript because of #26053. That's mostly correct, except that there are subtle difference between valid JavaScript and valid JSON. Specifically, https://search.google.com/structured-data/testing-tool/ reports that \x3c style escaping is not correct for LD JSON. It needs to be \u003c instead.