CVE-2023-24538

Templates do not properly consider backticks (`) as Javascript string
delimiters, and do not escape them as expected. Backticks are used, since
ES6, for JS template literals. If a template contains a Go template action
within a Javascript template literal, the contents of the action can be
used to terminate the literal, injecting arbitrary Javascript code into the
Go template. As ES6 template literals are rather complex, and themselves
can do string interpolation, the decision was made to simply disallow Go
template actions from being used inside of them (e.g. “var a = {{.}}”),
since there is no obviously safe way to allow this behavior. This takes the
same approach as github.com/google/safehtml. With fix, Template.Parse
returns an Error when it encounters templates like this, with an ErrorCode
of value 12. This ErrorCode is currently unexported, but will be exported
in the release of Go 1.21. Users who rely on the previous behavior can
re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that
backticks will now be escaped. This should be used with caution.