38

When I'm calling a Go template function to output HTML, it displays ZgotmplZ.

Sample code:

http://play.golang.org/p/tfuJa_pFkm

package main

import (
    "html/template"
    "os"
)

func main() {
    funcMap := template.FuncMap{
        "printSelected": func(s string) string {
            if s == "test" {
                return `selected="selected"`
            }
            return ""
        },

        "safe": func(s string) template.HTML {
            return template.HTML(s)
        },
    }
    template.Must(template.New("Template").Funcs(funcMap).Parse(`
    <option {{ printSelected "test" }} {{ printSelected "test" | safe }} >test</option>
    `)).Execute(os.Stdout, nil)

}

Output:

<option ZgotmplZ ZgotmplZ >test</option>

7 Answers 7

37

"ZgotmplZ" is a special value that indicates that unsafe content reached a CSS or URL context at runtime. The output of the example will be:

 <img src="#ZgotmplZ">

You can add a safe and attr function to the template funcMap:

package main

import (
    "html/template"
    "os"
)

func main() {
    funcMap := template.FuncMap{
        "attr":func(s string) template.HTMLAttr{
            return template.HTMLAttr(s)
        },
        "safe": func(s string) template.HTML {
            return template.HTML(s)
         },
    }

    template.Must(template.New("Template").Funcs(funcMap).Parse(`
    <option {{  .attr |attr }} >test</option>
        {{.html|safe}}
     `)).Execute(os.Stdout,   map[string]string{"attr":`selected="selected"`,"html":`<option selected="selected">option</option>`})
}

The output will look like:

<option selected="selected" >test</option>
<option selected="selected">option</option>

You may want to define some other functions which can convert string to template.CSS, template.JS, template.JSStr, template.URL etc.

5
  • 3
    This doesn't work either, FYI (for a function that takes input and uses it in the output). Feb 10, 2013 at 17:08
  • safe can let you display raw html in template.
    – Joe
    Feb 13, 2013 at 2:31
  • 2
    Use template.HTMLAttr instead of template.HTML, it work fine. see updated code.
    – Joe
    Feb 14, 2013 at 11:18
  • This works, thanks. Demonstrated for posterity: play.golang.org/p/nq3-7GYAoY Feb 14, 2013 at 23:27
  • function iteral is unessary Nov 23, 2019 at 17:52
9

I had similar problem with <img src="{{myfunction}}"> where myfunction return encoded image.

Finally I solved it when instead of string function return template.URL(mystring).

4

You are trying to output HTML in a place where template/html thinks is unsafe (for example, inside an HTML element, like this:

<option {{ printSelected }}>

I cannot find any way to convince it it is safe (including returning template.HTML instead of string); the only alternative I have found is to rewrite the template, in this example use a bool output instead:

<option {{ if printSelected }}selected{{ end }}>
1
  • Personally, I prefer your suggestion, for a simple reason: notwithstanding all the other correct answers, yours — while possibly 'more verbose' — is the only one that guarantees that unsafe content will never reach the template. This, IMHO, should be the best way of doing things. Any tricks or hacks which rely on 'fooling' Go to accept potential unsafe code is... well, not safe, is it? Jun 16, 2020 at 19:31
4
package main

import (
    "html/template"
    "os"
)

type T struct {
    HTML template.HTML
    ATTR template.HTMLAttr
    URL  template.URL
    JS   template.JS
    CSS  template.CSS
}

func main() {

    data := T{
        HTML: `<div>test div</div>`,
        ATTR: `selected="selected"`,
        URL:  `https://upload.wikimedia.org/wikipedia/commons/5/53/Google_%22G%22_Logo.svg`,
        CSS:  `font-size: 15px`,
        JS:   `console.log("hello world")`,
    }

    template.Must(template.New("Template").Parse(`
        {{.HTML}}
        <option {{.ATTR}} style="{{.CSS}}">test</option>
        <script>{{.JS}}</script>
        <img src="{{.URL}}">
    `)).Execute(os.Stdout, data)
}

output

<div>test div</div>
<option selected="selected" style="font-size: 15px">test</option>
<script>console.log("hello world")</script>
<img src="https://upload.wikimedia.org/wikipedia/commons/5/53/Google_%22G%22_Logo.svg">

playground Example

0
3

easiest way:

import "html/template"
yourhref = template.URL(yourhref)
1
  • This is the correct answer if you want to render text into href attribute like: <a href="{{.Host}}">Hi</a>, Host should be template.URL to avoid ZgotmplZ.
    – JCC
    Mar 25, 2021 at 4:32
1

You should wrap the string in an HTMLAttr, which was designed for text that gets injected in between angle brackets. Per the documentation:

https://golang.org/pkg/html/template/#HTMLAttr

HTMLAttr encapsulates an HTML attribute from a trusted source, for example,  dir="ltr".

Use of this type presents a security risk: the encapsulated content should come from a trusted source, as it will be included verbatim in the template output.

type HTMLAttr string

0

I was trying to insert an image from frontmatter into my template but kept getting the same error. I solved it thus:

{{ if isset .Params "image" }}
    {{ $myVar := print .Params.image }}
    <img src="{{ $myVar }}">
{{ end }}

Notice that I first save the .Params.image as a variable, and then insert it as my src.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.