[OE-core][scarthgap][PATCH 2/2] go: Fix CVE-2026-39823

["Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <hthakar@cisco.com>]

From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/golang/go/commit/f0384f7c664892ed3ee8c0fec68638d9b3b01811
[2] https://pkg.go.dev/vuln/GO-2026-4982

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-devtools/go/go-1.22.12.inc       |   1 +
 .../go/go/CVE-2026-39823.patch                | 100 ++++++++++++++++++
 2 files changed, 101 insertions(+)
 create mode 100644 meta/recipes-devtools/go/go/CVE-2026-39823.patch

diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
index ee2f5ca277..a2c0efa378 100644
--- a/meta/recipes-devtools/go/go-1.22.12.inc
+++ b/meta/recipes-devtools/go/go-1.22.12.inc
@@ -63,6 +63,7 @@ SRC_URI += "\
     file://CVE-2026-32288.patch \
     file://CVE-2026-27145.patch \
     file://CVE-2026-33814.patch \
+    file://CVE-2026-39823.patch \
 "
 SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
 
diff --git a/meta/recipes-devtools/go/go/CVE-2026-39823.patch b/meta/recipes-devtools/go/go/CVE-2026-39823.patch
new file mode 100644
index 0000000000..00e25bb35c
--- /dev/null
+++ b/meta/recipes-devtools/go/go/CVE-2026-39823.patch
@@ -0,0 +1,100 @@
+From 4915efb53a017a136a233a7676e80858d5b6e560 Mon Sep 17 00:00:00 2001
+From: Neal Patel <nealpatel@google.com>
+Date: Wed, 22 Apr 2026 18:41:25 -0400
+Subject: [PATCH] [release-branch.go1.25] html/template: fix escaping of URLs
+ in meta content attributes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The WHATWG "shared declarative refresh steps" algorithm (§4.2.5.3)
+skips ASCII whitespace between "url" and "=" when parsing the URL
+portion of a meta content attribute.
+
+Thank you to Samy Ghannad for reporting this issue.
+
+Updates #78913
+Fixes #79031
+Fixes CVE-2026-39823
+
+Change-Id: I7fc3bb9394b95e07b9b10fbc95725a3de6791774
+Reviewed-on: https://go-review.googlesource.com/c/go/+/769920
+Reviewed-by: Roland Shoemaker <roland@golang.org>
+TryBot-Bypass: Roland Shoemaker <roland@golang.org>
+(cherry picked from commit f2ec1254ff32fa39f3ce4faf72bbe44eeeeebad9)
+Reviewed-on: https://go-review.googlesource.com/c/go/+/772101
+LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
+
+CVE: CVE-2026-39823
+Upstream-Status: Backport [https://github.com/golang/go/commit/f0384f7c664892ed3ee8c0fec68638d9b3b01811]
+
+(cherry picked from commit f0384f7c664892ed3ee8c0fec68638d9b3b01811)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ src/html/template/escape_test.go | 20 ++++++++++++++++++++
+ src/html/template/transition.go  | 12 +++++++-----
+ 2 files changed, 27 insertions(+), 5 deletions(-)
+
+diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go
+index ce064407384..c9e566a9076 100644
+--- a/src/html/template/escape_test.go
++++ b/src/html/template/escape_test.go
+@@ -759,6 +759,26 @@ func TestEscape(t *testing.T) {
+ 			`<meta http-equiv="refresh" content="{{"asd: 123"}}">`,
+ 			`<meta http-equiv="refresh" content="asd: 123">`,
+ 		},
++		{
++			"meta content url with whitespace before equals",
++			`<meta http-equiv="refresh" content="0;url ={{"javascript:alert(1)"}}">`,
++			`<meta http-equiv="refresh" content="0;url =#ZgotmplZ">`,
++		},
++		{
++			"meta content url with tab before equals",
++			"<meta http-equiv=\"refresh\" content=\"0;url\t={{\"javascript:alert(1)\"}}\">",
++			"<meta http-equiv=\"refresh\" content=\"0;url\t=#ZgotmplZ\">",
++		},
++		{
++			"meta content url with space after equals",
++			`<meta http-equiv="refresh" content="0;url= {{"javascript:alert(1)"}}">`,
++			`<meta http-equiv="refresh" content="0;url= #ZgotmplZ">`,
++		},
++		{
++			"meta content url with whitespace both sides of equals",
++			"<meta http-equiv=\"refresh\" content=\"0;url \t= {{\"javascript:alert(1)\"}}\">",
++			"<meta http-equiv=\"refresh\" content=\"0;url \t= #ZgotmplZ\">",
++		},
+ 	}
+ 
+ 	for _, test := range tests {
+diff --git a/src/html/template/transition.go b/src/html/template/transition.go
+index 5aa3c35440b..ac05d56b418 100644
+--- a/src/html/template/transition.go
++++ b/src/html/template/transition.go
+@@ -626,10 +626,12 @@ func tError(c context, s []byte) (context, int) {
+ 
+ // tMetaContent is the context transition function for the meta content attribute state.
+ func tMetaContent(c context, s []byte) (context, int) {
+-	for i := 0; i < len(s); i++ {
+-		if i+3 <= len(s)-1 && bytes.Equal(bytes.ToLower(s[i:i+4]), []byte("url=")) {
+-			c.state = stateMetaContentURL
+-			return c, i + 4
++	for i := range len(s) {
++		if i+3 <= len(s)-1 && bytes.EqualFold(s[i:i+3], []byte("url")) {
++			if j := eatWhiteSpace(s, i+3); j < len(s) && s[j] == '=' {
++				c.state = stateMetaContentURL
++				return c, j + 1
++			}
+ 		}
+ 	}
+ 	return c, len(s)
+@@ -637,7 +639,7 @@ func tMetaContent(c context, s []byte) (context, int) {
+ 
+ // tMetaContentURL is the context transition function for the "url=" part of a meta content attribute state.
+ func tMetaContentURL(c context, s []byte) (context, int) {
+-	for i := 0; i < len(s); i++ {
++	for i := range len(s) {
+ 		if s[i] == ';' {
+ 			c.state = stateMetaContent
+ 			return c, i + 1
+-- 
+2.35.6
-- 
2.35.6