Bjørn Erik Pedersen
50ec65fbe1
ef02e34eCorrect the mmark example frontmatter parameter6e91e900SectionPagesMenu > sectionPagesMenu1a0db1a6Adjust sectionPagesMenuf9f87d9dFix extension's missing period.7062ae07Remove Press and Articles page771f2b38Remove outdated and redudant content file for release notes64cf47c3Remove outdated note in docs contribution guidebdb11b89Fix typo8324af70Fixes broken link on Roadmapd93f0992functions: Add all missing binary comparison operatorsfb7ae80aFix typo in usage.mdfbdae08bFix typo in content-management/taxonomies.md66fab8d2Make <title> less stutteryb3cd4c22Remove old temp release notes5589ba96Fix typos in templates/lists.mdaf3a0807http > HTTPb2af90aeRemove formatting in description of blog article6e2e60a9Add blog article about Netlify files0bb6f2f2Use title in archetype file7b2490ffGet the Archetypes up to new specf401d69bLoad CSS and JS via HTTP/2 server push4aef4944Adjust titles362acdb2Fix typo in quickstartc2440560Remove inline icons from installation guided2edcbc3Revert "Fix links to Disqus template documentation"622f49cfAdd a full commands section at the quick start end752f065bFix server command in README93e08e19Fix links to Disqus template documentation5e0cfaa9Adjust Linux installd51397c2Fix broken link in Quick Start1fb39846Add /quickstart alias to quickstart7440616bAdd new and simpler quickstartb3ec6986Let page title correspond to function name replaceREb44499c9Add YouTube tutorial about taxonomies88b9eb0eAdd RSS templates example6c0bde3fUpdate slice.md6c212ea6Reorder to match the following content orderd2122992Complete "content" spelling under theme componentse4824eb3Fix the output shortcode and its usage0adfc945Add archetypes YouTube video638e9d9bFix double "your" typo in taxonomies.md git-subtree-dir: docs git-subtree-split:ef02e34eaf
2.6 KiB
title, description, godocref, date, publishdate, lastmod, categories, menu, signature, workson, hugoversion, relatedfuncs, deprecated, aliases
| title | description | godocref | date | publishdate | lastmod | categories | menu | signature | workson | hugoversion | relatedfuncs | deprecated | aliases | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| safeURL | Declares the provided string as a safe URL or URL substring. | https://golang.org/pkg/html/template/#HTMLEscape | 2017-02-01 | 2017-02-01 | 2017-02-01 |
|
|
|
false |
safeURL declares the provided string as a "safe" URL or URL substring (see RFC 3986). A URL like javascript:checkThatFormNotEditedBeforeLeavingPage() from a trusted source should go in the page, but by default dynamic javascript: URLs are filtered out since they are a frequently exploited injection vector.
Without safeURL, only the URI schemes http:, https: and mailto: are considered safe by Go templates. If any other URI schemes (e.g., irc: and javascript:) are detected, the whole URL will be replaced with #ZgotmplZ. This is to "defang" any potential attack in the URL by rendering it useless.
The following examples use a site config.toml with the following menu entry:
{{< code file="config.toml" copy="false" >}} menu.main name = "IRC: #golang at freenode" url = "irc://irc.freenode.net/#golang" {{< /code >}}
The following is an example of a sidebar partial that may be used in conjunction with the preceding front matter example:
{{< code file="layouts/partials/bad-url-sidebar-menu.html" copy="false" >}}
-
{{ range .Site.Menus.main }}
- {{ .Name }} {{ end }}
This partial would produce the following HTML output:
{{< output file="bad-url-sidebar-menu-output.html" >}}
{{< /output >}}The odd output can be remedied by adding | safeURL to our .Title page variable:
{{< code file="layouts/partials/correct-url-sidebar-menu.html" copy="false" >}}
{{< /code >}}With the .URL page variable piped through safeURL, we get the desired output:
{{< output file="correct-url-sidebar-menu-output.html" >}}
{{< /output >}}