CVE-2018-17075: NULL Pointer Dereference (CWE-476)
value: The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <template><object>, <template><applet>, or <template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2018-09-16T02:29Z
Repository: https://github.com/golang/net
Language: Go
Files changed: html/parse.go, html/testdata/webkit/template.dat
Commit date: 2018-08-16 10:28:01 +0000
Commit message: html: remove special procedure for <template> in frameset im

See more details: https://bugs.chromium.org/p/chromium/issues/detail?id=829668

Updates golang/go#23071

Change-Id: Ib9c963269f814c3f21d3784754729df57dcc8f90
Reviewed-on: https://go-review.googlesource.com/123776
Run-TryBot: Kunpei Sakai <namusyaka@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Nigel Tao <nigeltao@golang.org>

Diff: diff --git a/html/parse.go b/html/parse.go
index d5b0aee..1489ff9 100644
--- a/html/parse.go
+++ b/html/parse.go
@@ -1069,17 +1069,11 @@ func inBodyIM(p *parser) bool {
 			if p.hasSelfClosingToken {
 				p.oe.pop()
 				p.acknowledgeSelfClosingTag()
 			}
 			return true
-		case a.Frame:
-			// TODO: remove this divergence from the HTML5 spec.
-			if p.oe.contains(a.Template) {
-				p.addElement()
-				return true
-			}
-		case a.Caption, a.Col, a.Colgroup, a.Head, a.Tbody, a.Td, a.Tfoot, a.Th, a.Thead, a.Tr:
+		case a.Caption, a.Col, a.Colgroup, a.Frame, a.Head, a.Tbody, a.Td, a.Tfoot, a.Th, a.Thead, a.Tr:
 			// Ignore the token.
 		default:
 			p.reconstructActiveFormattingElements()
 			p.addElement()
 		}
@@ -1923,15 +1917,10 @@ func inFramesetIM(p *parser) bool {
 			p.addElement()
 			p.oe.pop()
 			p.acknowledgeSelfClosingTag()
 		case a.Noframes:
 			return inHeadIM(p)
-		case a.Template:
-			// TODO: remove this divergence from the HTML5 spec.
-			//
-			// See https://bugs.chromium.org/p/chromium/issues/detail?id=829668
-			return inTemplateIM(p)
 		}
 	case EndTagToken:
 		switch p.tok.DataAtom {
 		case a.Frameset:
 			if p.oe.top().DataAtom != a.Html {
diff --git a/html/testdata/webkit/template.dat b/html/testdata/webkit/template.dat
index 2d6c0a7..f130961 100644
--- a/html/testdata/webkit/template.dat
+++ b/html/testdata/webkit/template.dat
@@ -475,24 +475,20 @@
 #errors
 #document
 | <html>
 |   <head>
 |   <frameset>
-|     <template>
-|       content
-|         <frame>
+|     <frame>
 
 #data
 <template><frame></frame></frameset><frame></frame></template>
 #errors
 #document
 | <html>
 |   <head>
 |     <template>
 |       content
-|         <frame>
-|         <frame>
 |   <body>
 
 #data
 <template><div><frameset><span></span></div><span></span></template>
 #errors
@@ -821,12 +817,10 @@
 | <html>
 |   a="b"
 |   <head>
 |     <template>
 |       content
-|         <frame>
-|         <frame>
 |   <body>
 
 #data
 <body><template><tr></tr><template></template><td></td></template>
 #errors

Vulnerable code: 		case a.Frame:
			// TODO: remove this divergence from the HTML5 spec.
			if p.oe.contains(a.Template) {
				p.addElement()
				return true
			}
		case a.Caption, a.Col, a.Colgroup, a.Head, a.Tbody, a.Td, a.Tfoot, a.Th, a.Thead, a.Tr:
		case a.Template:
			// TODO: remove this divergence from the HTML5 spec.
			//
			// See https://bugs.chromium.org/p/chromium/issues/detail?id=829668
			return inTemplateIM(p)
|     <template>
|       content
|         <frame>
|         <frame>
|         <frame>
|         <frame>
|         <frame>
Fixed code: 		case a.Caption, a.Col, a.Colgroup, a.Frame, a.Head, a.Tbody, a.Td, a.Tfoot, a.Th, a.Thead, a.Tr:
|     <frame>