XSS (ARCH5101)

Key go.security.xss · Severity error · Category security · CWE CWE-79

Writing user input to HTML output without escaping (for example via template.HTML, which disables auto-escaping) lets attackers inject scripts.

Incorrect

func page(w http.ResponseWriter, r *http.Request) {
  name := r.URL.Query().Get("name")
  t := template.Must(template.New("p").Parse("<h1>{{.}}</h1>"))
  t.Execute(w, template.HTML(name)) // escaping bypassed
}

Correct

func page(w http.ResponseWriter, r *http.Request) {
  name := r.URL.Query().Get("name")
  t := template.Must(template.New("p").Parse("<h1>{{.}}</h1>"))
  t.Execute(w, name) // html/template auto-escapes
}

Fix

Rely on html/template auto-escaping; do not convert user input into types like template.HTML.