Google GitGoogle Git
Sign in
go/net/a452f3cc17168a60bc3f439a3ae0fcffc32eca0e
commit
a452f3cc17168a60bc3f439a3ae0fcffc32eca0e
[log]
author
Roland Shoemaker <roland@golang.org>
Fri May 08 12:09:06 2026 -0700
committer
Gopher Robot <gobot@golang.org>
Thu May 21 18:12:39 2026 -0700
tree
e38467e133478793a05b2417fc09baefacff2cca
parent
f8651996b24ba47d89dd9eb97fd47758e6d1886f [diff]
html: ignore duplicate attributes during tokenization

During tokenization ignore attributes with names we've already seen,
per WHATWG 13.2.5.33. This removes a parser misalignment that could be
leveraged to confuse sanitizers.

Thanks to ensy for reporting this issue.

Fixes CVE-2026-27136

Change-Id: Ib0a3edb8dbea35c431f74f8b0bbe6229625d7e1f
Reviewed-on: https://go-review.googlesource.com/c/net/+/781685
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-by: Nicholas Husin <nsh@golang.org>
TryBot-Bypass: Roland Shoemaker <roland@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Nicholas Husin <husin@google.com>
2 files changed
tree: e38467e133478793a05b2417fc09baefacff2cca
  1. bpf/
  2. context/
  3. dict/
  4. dns/
  5. html/
  6. http/
  7. http2/
  8. http3/
  9. icmp/
  10. idna/
  11. internal/
  12. ipv4/
  13. ipv6/
  14. lif/
  15. nettest/
  16. netutil/
  17. proxy/
  18. publicsuffix/
  19. quic/
  20. route/
  21. trace/
  22. webdav/
  23. websocket/
  24. xsrftoken/
  25. .gitattributes
  26. .gitignore
  27. codereview.cfg
  28. CONTRIBUTING.md
  29. go.mod
  30. go.sum
  31. LICENSE
  32. PATENTS
  33. README.md
README.md

Go Networking

Go Reference

This repository holds supplementary Go networking packages.

Report Issues / Send Patches

This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.

The git repository is https://go.googlesource.com/net.

The main issue tracker for the net repository is located at https://go.dev/issues. Prefix your issue with “x/net:” in the subject line, so it is easy to find.