evcc-io / evcc

Solar Charging ☀️🚘
https://evcc.io
MIT License
3.63k stars 674 forks source link

Change from html/template to text/template for ReplaceFormatted() #17358

Closed rhuss closed 1 day ago

rhuss commented 2 days ago

In format.go, probably accidentally, html/template is used instead of text/template for allowing parameterization of various backend configuration. While the differences are subtle, it can hurt when characters like '<' or '>' are used in the configuration for inline templates (like when sending XML payload for messaging events).

In this scenario it shoudl be more robust to use text/template, as the HTML escaping is not really needed here.