tree 3eadd6cc20a48f86022dca672b72726cbb885742
parent 1a5e07d1ff72da30f660d3c95b312a20be31173c
author Gregory Man <man.gregory@gmail.com> 1568898000 +0300
committer Brad Fitzpatrick <bradfitz@golang.org> 1569256096 +0000

xsrftoken: escape colons

The current clean() replaces : with _ (colons are internally used as
separators).
This produce can produce same output for different inputs, for example
the user _foo_ can obtain valid tokens for user :foo:.

This CL replace colons with double colons instead of replacing them
with underscores.

Fixes golang/go#34308

Change-Id: I3e4148a0836e62fda1a5f0ba32b375121368afd3
Reviewed-on: https://go-review.googlesource.com/c/net/+/196457
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>