From fc9b869df4d80f66b8c5627569a8ccfa95bfa485 Mon Sep 17 00:00:00 2001
From: ai-anant <ant2010in@gmail.com>
Date: Fri, 28 Aug 2026 14:54:15 +0530
Subject: [PATCH] feat(go): detect non-constant argument to template.HTML(...)
 escaping bypass (CWE-79)

---
 go/xss/template-html-taint.yaml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 go/xss/template-html-taint.yaml

diff --git a/go/xss/template-html-taint.yaml b/go/xss/template-html-taint.yaml
new file mode 100644
index 0000000..4997c69
--- /dev/null
+++ b/go/xss/template-html-taint.yaml
@@ -0,0 +1,33 @@
+rules:
+  - id: codevigilant.go.xss.template-html.taint
+    languages:
+      - go
+    severity: HIGH
+    message: >-
+      Argument passed to html/template.(HTML) conversion is not a string
+      constant. template.HTML(...) bypasses Go's automatic HTML escaping, so
+      any data reaching the rendered page through this value that originates
+      from user-controlled or file-derived input is emitted verbatim and can
+      lead to stored/reflected Cross-Site Scripting (CWE-79). Only wrap a
+      compile-time literal (a constant) with template.HTML; for dynamic data
+      keep it a plain string so html/template escapes it, or pass through an
+      allowlist-based sanitizer.
+    cwe: CWE-79
+    owasp:
+      - A03:2021 - Injection
+    technology:
+      - go
+      - html/template
+    confidence: MEDIUM
+    references:
+      - https://pkg.go.dev/html/template
+      - https://owasp.org/www-community/attacks/xss/
+    source: https://github.com/ai-anant/bug_hunting
+    license: MIT
+    patterns:
+      - pattern: template.HTML($X)
+      - pattern-not: template.HTML("...")          # constant literal is safe
+    metadata:
+      category: security
+      pattern-type: taint
+      source: bug-hunting
\ No newline at end of file