Template Injection (ARCH5130)

Key go.security.template-injection · Severity error · Category security · CWE CWE-1336

Building the template text itself from user input lets attackers inject template directives (SSTI) and execute code on the server.

Incorrect

func render(w http.ResponseWriter, r *http.Request) {
  src := "Hello " + r.URL.Query().Get("name")
  t := template.Must(template.New("p").Parse(src))
  t.Execute(w, nil)
}

Correct

var tmpl = template.Must(template.New("p").Parse("Hello {{.Name}}"))

func render(w http.ResponseWriter, r *http.Request) {
  tmpl.Execute(w, struct{ Name string }{r.URL.Query().Get("name")})
}

Fix

Compile templates from fixed sources and pass user input only as data, never into the template text.