XSS Template HTML Bypass
Converting a dynamic value to template.HTML (or template.JS/template.CSS/ template.URL) marks it as trusted and bypasses html/template's contextual auto-escaping, enabling XSS (CWE-79) if the value contains attacker input.
Standards mapping
- OWASP Top 10
- A03:2021 - Injection
- OWASP ASVS
- V5.3.3 (L1)
Vulnerable vs. safe
return template.HTML(userInput)return template.HTML("<b>static developer markup</b>")Why it matters & how to fix it
Converting a dynamic value to template.HTML (or template.JS/template.CSS/ template.URL) marks it as trusted and bypasses html/template's contextual auto-escaping, enabling XSS (CWE-79) if the value contains attacker input. Only wrap constant, developer-authored markup in template.HTML. Pass user data as a plain string and let html/template escape it, or sanitize with a vetted HTML sanitizer (e.g. bluemonday) first.
References
Rule ID integsec-go-xss-template-html-bypass - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - Cross-Site Scripting (XSS)DOM XSS Innerhtml Sink
- JavaScript / TypeScript - Cross-Site Scripting (XSS)Reflected XSS Response Tainted Input
- JavaScript / TypeScript - Cross-Site Scripting (XSS)React Dangerously Set Inner HTML
- Go - Cross-Site Scripting (XSS)Text Template For HTML
- Go - Cross-Site Scripting (XSS)XSS Response Write
- Ruby - Cross-Site Scripting (XSS)XSS HTML Safe Interpolation