html/template package — the safe version of text/template. Auto-escapes context-appropriately. HTML(), JS(), URL() types are escape bypasses when used with user input.
.HTML().JS().URL().HTML()SinkHTML(string)
Marks string as safe HTML — bypasses auto-escaping. XSS sink when value is user-controlled.
0.JS()SinkJS(string)
Marks string as safe JavaScript — bypasses auto-escaping. XSS sink.
0.URL()SinkURL(string)
Marks string as safe URL — bypasses sanitization. Open redirect sink.
0| FQN | Field | |
|---|---|---|
| html/template | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
// standard library — no go.mod entry required
from codepathfinder.go_rule import GoHTMLTemplate