Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Since your question was <em>Why</em>, I will try to explain why comments are stripped away.</p> <p>First of all, the purpose of the <code>html/template</code> package is to be <em>safe</em>. The <a href="http://golang.org/pkg/html/template/#pkg-overview" rel="noreferrer">documentation</a> states:</p> <blockquote> <p>Package template (html/template) implements data-driven templates for generating HTML output safe against code injection.</p> </blockquote> <p>This is done through context-sensitive escaping. In a <a href="https://groups.google.com/forum/#!topic/golang-nuts/8y6by6SERyU" rel="noreferrer">Golang-nuts thread</a> Kyle Lemons provide an example where conditional comments would currently break this safety unless the comments were stripped away:</p> <pre><code>&lt;p&gt; &lt;!--[if lt IE 9]&gt;&lt;script&gt;&lt;![endif]--&gt; {{.Stuff}} &lt;!--[if lt IE 9]&gt;&lt;/script&gt;&lt;![endif]--&gt; &lt;/p&gt; </code></pre> <p>In this case, any value in {{.Stuff}} will be executed as Javascript on some browsers and should therefore be escaped to be safe . This would require the template engine to be aware of this browser-specific interpretation of the comment, and any other non-standard behavior in all the browsers out there. This is not feasible.</p> <p>Instead, <code>html/template</code> was designed to strip away any comments to ensure that the HTML it produces is safe from any injection attack.</p> <p><strong>Workaround</strong></p> <p>As mentioned by Dave, it is possible to use <code>template.HTML</code> to insert such comments. However, because of the security risk, the <a href="http://golang.org/pkg/html/template/#HTML" rel="noreferrer">documentation</a> for <code>template.HTML</code> states (my emphasis):</p> <blockquote> <p>HTML encapsulates a known safe HTML document fragment. It should not be used for HTML from a third-party, or HTML with unclosed tags or <em>comments</em>.</p> </blockquote>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload