提升Go模板安全性

iwind · iwind · commit d515a201296a · 2023-12-14T19:57:02.000+08:00
diff --git a/web/views/@default/@layout.html b/web/views/@default/@layout.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html lang="zh">
 <head>
-    <title>{$.teaTitle}</title>
+    <title>{$ htmlEncode .teaTitle}</title>
     <meta charset="UTF-8"/>
     <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=0">
     {$if eq .teaFaviconFileId 0}
diff --git a/web/views/@default/@layout_popup.html b/web/views/@default/@layout_popup.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
 <head>
-	<title>{$.teaTitle}控制台</title>
+	<title>{$ htmlEncode .teaTitle}控制台</title>
 	<meta charset="UTF-8"/>
 	<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=0">
     {$if eq .teaFaviconFileId 0}
diff --git a/web/views/@default/index/index.html b/web/views/@default/index/index.html
@@ -7,7 +7,7 @@
     {$else}
     <link rel="shortcut icon" href="/ui/image/{$ .faviconFileId}"/>
     {$end}
-    <title>登录{$.systemName}</title>
+    <title>登录{$ htmlEncode .systemName}</title>
 	<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=0">
     {$TEA.VUE}
     {$TEA.SEMANTIC}
@@ -27,7 +27,7 @@
 			<input type="hidden" name="token" v-model="token"/>
 			<div class="ui segment stacked">
 				<div class="ui header">
-					登录{$.systemName}
+					登录{$ htmlEncode .systemName}
 				</div>
 				<div class="ui field">
 					<div class="ui left icon input">
diff --git a/web/views/@default/index/otp.html b/web/views/@default/index/otp.html
@@ -7,7 +7,7 @@
     {$else}
     <link rel="shortcut icon" href="/ui/image/{$ .faviconFileId}"/>
     {$end}
-    <title>登录{$.systemName} - 二次验证</title>
+    <title>登录{$ htmlEncode .systemName} - 二次验证</title>
     <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=0">
     {$TEA.VUE}
     {$TEA.SEMANTIC}
@@ -27,7 +27,7 @@
             <input type="hidden" name="remember" :value="remember ? 1 : 0"/>
             <div class="ui segment stacked">
                 <div class="ui header">
-                    登录{$.systemName}
+                    登录{$ htmlEncode .systemName}
                 </div>
                 <div class="ui field">
                     为了保护你的账户安全，需要进行OTP二次身份验证。
