0

Related to this question, I have some Golang code here. Currently, the localhost:8080/search-availability renders properly. Its content is as follows:

img

If I were to change line 13 of templates\search-availability.page.tmpl:

<input type="text" name="csrf_token" value="{{.CsrfToken}}">

into:

<input type="text" name="csrf_token" value="{{.WrongToken}}">

anything below Search for Availability will disappear.

To debug the issue mentioned in the other question, I want to do a rename in pkg\models\templatedata.go:

type TemplateData struct {
    StringMap map[string]string
    IntMap    map[string]int
    FloatMap  map[string]float64
    Data      map[string]interface{}
    // CsrfToken string
    Token string
    Flash     string
    Error     string
}

Basically, CsrfToken gets shortened into Token. To accommodate the change, line 13 of templates\search-availability.page.tmpl is changed into:

<!-- <input type="text" name="csrf_token" value="{{.CsrfToken}}"> -->
<input type="text" name="csrf_token" value="{{.Token}}">

(I only comment out the old value. This will be clear later.) Accordingly, pkg\render\render.go has this change:

func AddDefaultData(td *models.TemplateData, r *http.Request) *models.TemplateData {
    // td.CsrfToken = nosurf.Token(r)
    fmt.Printf("Token before: %s\n", td.Token)
    td.Token = nosurf.Token(r)
    fmt.Printf("Token after: %s\n", td.Token)
    return td
}

Then I run go run ./cmd/web/*.go to see if it works. Surprisingly, everything below Search for Availability is missing. This is the output from the terminal:

Starting a server on port :8080
2023/03/12 23:54:46 SessionLoad
2023/03/12 23:54:46 NoSurf
2023/03/12 23:54:47 Hit the page
2023/03/12 23:54:47 Availability
Token before: 
Token after: ERyPRtSgyVxmtthfMD49BsysXczubQfn7SQ3+L0ntc+6PQoHlaykAYejIa6Vw4m4omkgO94tVi/YiD0baSz2yw==

VS Code code complete can pick up td.Token and the terminal shows that that variable exists. Why is it behaving just like when WrongToken is used? Removing both of these lines brings back the content from Arrival and after:

<!-- <input type="text" name="csrf_token" value="{{.CsrfToken}}"> -->
<input type="text" name="csrf_token" value="{{.Token}}">

I am at a loss here. Why is this happening? Any insight is greatly appreciated.

Rob
  • 14,746
  • 28
  • 47
  • 65
CaTx
  • 1,421
  • 4
  • 21
  • 42
  • 3
    Your structure does not have a `WrongToken` field. If you commented out `CsrfToken`, then the structure no longer has that either. Commenting out the HTML template does not remove it from the output, your template is still looking for `CsrfToken` variable. – Burak Serdar Mar 12 '23 at 17:07
  • 2
    Please consider handling errors instead of ignoring them. The standard template's `Execute` methods return an `error` if they encounter an issue like a missing struct field. – mkopriva Mar 12 '23 at 19:26

1 Answers1

0

Template expressions within HTML comments are still evaluated. The presence of a non-existent field will cause Execute() to stop and return an error.

Alternatively, you can use a template comment (see the first entry in the list of actions in the text/template documentation). This will cause the enclosed content to be discarded when executing the template.

Here's a small example to illustrate:

package main

import (
    "html/template"
    "log"
    "os"
)

func main() {
    const validTpl = `
<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8">
        <title>example page</title>
    </head>
    <body>
        A field: {{.Field}}<br>
        A non-existent field within a template comment: {{/* {{.NonExistenField}} within a template comment */}}
        A non-existent field within an HTML comment: <!-- {{.NonExistentField}} -->
    </body>
</html>`

    t, err := template.New("webpage").Parse(validTpl)
    if err != nil {
        log.Fatal(err)
    }

    data := struct {
        Field string
    }{
        Field: "data",
    }

    err = t.Execute(os.Stdout, data)
    if err != nil {
        log.Fatal(err)
    }
}

Output:

<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8">
        <title>example page</title>
    </head>
    <body>
        A field: data<br>
        A non-existent field within a template comment: 
        A non-existent field within an HTML comment: 2009/11/10 23:00:00 template: webpage:11:54: executing "webpage" at <.NonExistentField>: can't evaluate field NonExistentField in type struct { Field string }

Program exited.

Go Playground

chuckx
  • 6,484
  • 1
  • 22
  • 23