Manuel Rüger 807d057f7b stdlib: remove duplicate err check in New() and add XML escaping to user-controlled template values ...

Remove the dead second 'if err != nil' block after the already-checked
lib.Templates assignment.

Add html.EscapeString as 'xmlesc' template function and apply it to
user-controlled string parameters in ac:code, ac:status, and ac:box
templates. Values like .Title, .Color, .Language, and .Theme can contain
XML special characters (<, >, &, ") when supplied by users, which would
break Confluence storage format XML structure.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-03-16 19:18:29 +01:00

..

stdlib.go

stdlib: remove duplicate err check in New() and add XML escaping to user-controlled template values

2026-03-16 19:18:29 +01:00