html/template: reject dynamic substrings in attribute names

[mohammadmseet-hue]

Fix a security vulnerability in html/template where splitting an
HTML attribute name across static template text and a dynamic
template action bypasses context-sensitive escaping.

When a template like <a hre{{.S}}="{{.U}}"> is executed with
S="f" and U="javascript:alert(1)", the output is
-- the javascript: URI passes
through unfiltered because the escaper only sees the static
prefix "hre" (which maps to contentTypePlain) and never applies
URL filtering.

Affected attributes: href, src, action, formaction, style,
and all event handlers (on*).

Affected versions: All Go versions through 1.24.4 and the
development branch.

Fix: Track when an attribute name in static text runs to the
end of a text node boundary (the partialName flag on context).
If a template action is encountered while partialName is true,
return an ErrBadHTML error at parse time instead of applying
the insufficient htmlNameFilter.

The fix preserves all valid patterns:

• (full dynamic attribute name)
• (static attribute name)
• <input{{if .T}} checked{{end}}> (conditional attributes)
• <a{{.Attrs}}> (typed HTMLAttr injection)

This is a partial fix for #19669 covering the attribute name
case.

PoC:

t := template.Must(template.New("x").Parse(
<a hre{{.S}}="{{.U}}">))
var b strings.Builder
t.Execute(&b, struct{S,U string}{
"f", "javascript:alert(1)"})
// Before fix: (XSS!)
// After fix: error at parse time

Test plan:

• All existing html/template tests pass
• 6 split-attribute XSS variants correctly rejected
• 5 valid patterns continue to work
• TestTypedContent passes (typed HTMLAttr injection)
• Branch/conditional templates do not false-positive

Fixes #19669

[gopherbot]

This PR (HEAD: cff81f9) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/762603.

Important tips:

• Don't comment on this PR. All discussion takes place in Gerrit.
• You need a Gmail or other Google account to log in to Gerrit.
• To change your code in response to feedback:
  • Push a new commit to the branch used by your GitHub PR.
  • A new "patch set" will then appear in Gerrit.
  • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
  • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
  • Multiple commits in the PR will be squashed by GerritBot.
• The title and description of the GitHub PR are used to construct the final commit message.
  • Edit these as needed via the GitHub web interface (not via Gerrit or git).
  • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
• See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

[gopherbot]

Message from Gopher Robot:

Patch Set 1:

(1 comment)

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/762603.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from Mohammad Seet:

Patch Set 2:

(1 comment)

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/762603.
After addressing review feedback, remember to publish your drafts!