incorrect escaping

[simevo]

What version of Hugo are you using (hugo version)?

The stock package on Debian bookworm:

$ hugo version
hugo v0.110.0+extended linux/amd64 BuildDate=2023-01-27T10:03:29Z VendorInfo=debian:0.110.0-1

Does this issue reproduce with the latest release?

Yes, this is the latest release.

Problem description

I configure a global parameter baseURL = "/", and request it to be inserted as known-safe JavaScript (https://gohugo.io/functions/safejs/) within some backtick-delimited JavaScript strings inside a <script> tag.

In certain cases the slash is incorrectly escaped.

Minimal example

Extract minimal.zip in /tmp/minimal, launch hugo, then look at public/index.html:

      let a = `/</`
      let b = `\//`
      let c = `//`

based on the layouts/shortcodes/home_map.html shortcode:

      let a = `{{ .Site.BaseURL | safeJS }}</`
      let b = `{{ .Site.BaseURL | safeJS }}/`
      let c = `{{ .Site.BaseURL | safeJS }}/`

I'd have expected this output:

      let a = `/</`
      let b = `//`
      let c = `//`

but the slash in the second string is escaped. If you remove the < line from the first string, all urls are correctly unescaped.

Something weird is going on!

[jmooring]

This seems like a bug (due to inconsistent output when comparing lines 2 and 3) in Go's html/template package. If I switch to using Go's text/template package with...

[outputFormats.HTML]
isPlainText = true

... I get the expected results:

 <script>
let a = `/</`
let b = `//`
let c = `//`
</script>

With the default output configuration (using Go's html/template package), if I pass the entire string through safeJS I also get the expected results:

<script>
  let a = `{{ printf "%s</" site.BaseURL | safeJS }}`
  let b = `{{ printf "%s/" site.BaseURL | safeJS }}`
  let c = `{{ printf "%s/" site.BaseURL | safeJS }}`
</script>

[bep]

I (think) this should test it in Go: https://go.dev/play/p/uHRYjxnzIaI?v=goprev

But that gives me:

let a = `/</`
let b = `//`
let c = `//`

Which I also assume is not correct.

[bep]

OK, revisiting this with:

https://go.dev/play/p/Nl4_5-ynidw?v=goprev

Wrapping it in <script> makes it behave different, but still wrong, I guess.

[jmooring]

Do you want me to log an issue upstream?

[bep]

Do you want me to log an issue upstream?

Yes, that would be good (I suspect they're a little tired of my issue "spamming").

[jmooring]

golang/go#58460

[jmooring]

The original issue was opened on Dec 3, 2014.
golang/go#9200

[karelbilek]

This is a known go bug with no easy solution

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.