Jakub Zych 7333f450ad fix(10.1): WR-03 walk the whole partial view model before rendering ...

refusedViewModel compared only the top-level type with the controller's
model. It now walks the type through pointers, slices, arrays, maps,
struct fields and the results of exported methods, and the values held
in interface-typed members, refusing the controller's model, any other
GORM model (TableName, a gorm tag, gorm.Model, gorm.DeletedAt) and
html/template's trusted content types anywhere in that structure.

2026-09-29 09:54:35 +02:00

13 KiB

Raw Blame History

View Raw